Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
18/01/2024, 22:53
General
-
Target
2024-01-18_6b0f59414fc3023d7828b2e85bda2ea6_mafia.exe
-
Size
428KB
-
MD5
6b0f59414fc3023d7828b2e85bda2ea6
-
SHA1
4b63985c3ab70c96002fea614c645e7fd0ade50a
-
SHA256
0da63b70f63ab6e7b353862a3e60a1c171024dc582ac04a978d3b3a212558f55
-
SHA512
7ec27cc72328aedc5346869ab55200300facd37a09dddea1385714a1f1c105188a65ab886757776eda66522bed29253f586c7b595d6ded994690e9b8841ef281
-
SSDEEP
12288:Z594+AcL4tBekiuKzErn9TLZJEm3JUTyzpqyqHgG6LIkZ5yVl:BL4tBekiuVr9T1JEm3JU2z+qPZkV
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-18_6b0f59414fc3023d7828b2e85bda2ea6_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-18_6b0f59414fc3023d7828b2e85bda2ea6_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\D9FA.tmp"C:\Users\Admin\AppData\Local\Temp\D9FA.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-18_6b0f59414fc3023d7828b2e85bda2ea6_mafia.exe 48614D574A0D7A893A6257CC4034DC09FCFA8709D0820D7C3B47B6E384A8B19C1091B23CE846276DE5793E9947801A3B218E1F8C4583576060A0948A31B407002⤵
- Deletes itself
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
428KB
MD564378de0f345f453ea5b7c20407cd8cb
SHA1f855cde8ca9ef20058f6aab36502b3114244f09c
SHA2561a09e816d5b4cea7d536a04aa173e8a63231285e31245fbb957d30f2b871670c
SHA512f7851700f23a662e60f72846dac081984223428fb92caae349360695e32551e05c1e0d66bab64913c9af80d6b8035c08734eda1ed9c14c972a2ec9d5d545a927