91219b47730c1ddb48d2378e72ee4037d1a6e37f351fc978f318d0a0a6a9c0aa

Analysis

max time kernel
138s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23-01-2024 18:24

Target

2024-01-23_0f2c0613e35e3008082a70f804b2a3df_mafia.exe
Size

411KB
MD5

0f2c0613e35e3008082a70f804b2a3df
SHA1

bc71a428e524a112e03d38ffbd6aebddbefbc742
SHA256

91219b47730c1ddb48d2378e72ee4037d1a6e37f351fc978f318d0a0a6a9c0aa
SHA512

2d858991a0dd5ea94885ba59da581c826bcc872c8502f1b0ebde34fc772d9429c759ba412038a3dd13dd07f13a918dddbdc6628e5e0ef28831fd086fc0d3a344
SSDEEP

6144:gVdvczEb7GUOpYWhNVynE/mFBKm902ew0TP4HL3qm/06wXcklo1qHI:gZLolhNVyEER0TG/5wXcF1qHI

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1996	CFB4.tmp

Executes dropped EXE 1 IoCs

pid	Process
1996	CFB4.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 1996	3960	2024-01-23_0f2c0613e35e3008082a70f804b2a3df_mafia.exe	89
PID 3960 wrote to memory of 1996	3960	2024-01-23_0f2c0613e35e3008082a70f804b2a3df_mafia.exe	89
PID 3960 wrote to memory of 1996	3960	2024-01-23_0f2c0613e35e3008082a70f804b2a3df_mafia.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-01-23_0f2c0613e35e3008082a70f804b2a3df_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-23_0f2c0613e35e3008082a70f804b2a3df_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Users\Admin\AppData\Local\Temp\CFB4.tmp
  "C:\Users\Admin\AppData\Local\Temp\CFB4.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-01-23_0f2c0613e35e3008082a70f804b2a3df_mafia.exe 21858D174A979A06501DDB9EFFAEB0879DAA5A5F6A96A8CC50CBEBE75D030EED20F9B386AA2E1EC97BCB1990086C1240D591C44A5F1D72F200E000429F2E5580
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1996

C:\Users\Admin\AppData\Local\Temp\CFB4.tmp

Filesize
411KB

MD5
18267f3b23159b63f6954146696bf6f9

SHA1
6e026b4a0a20538783579082e1ef4e6ac58882b1

SHA256
e1d33dd0d81d8685e35f0851c7295912022f080f142235abe625a7eda1ea4f66

SHA512
b14a3b0fd37eca9f3fab8de31f502877870f6889f648206d77f66ab62e896d6bf23761069ef90a4b2ee59ae89bea0367d309a920cf329875d8a872a1abd85b82

Download Submit