275668a7084ba833f8218df2b82f60ca2424b34c0fe42d6c886ca44282b1e7d7

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2024, 08:28

Target

2024-01-24_5d512b8c1ba51c2336e8da2eba3f1437_mafia.exe
Size

428KB
MD5

5d512b8c1ba51c2336e8da2eba3f1437
SHA1

8e104f8da8a301a4817197d900af9a733bd2a84a
SHA256

275668a7084ba833f8218df2b82f60ca2424b34c0fe42d6c886ca44282b1e7d7
SHA512

0432258784ac4a2fb63beaa90327ab678c93a9dfb26b48da2bea05cac1545a19b77c7bad5435a2affa272cae3125fc145319b74096a248fb0029355fbc6428f3
SSDEEP

12288:gZLolhNVyEyfbJsZDABHVRtE68xq3n+9qHR:gZqhOEyls9ArE+nN

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4900	7762.tmp

Executes dropped EXE 1 IoCs

pid	Process
4900	7762.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 4900	1268	2024-01-24_5d512b8c1ba51c2336e8da2eba3f1437_mafia.exe	85
PID 1268 wrote to memory of 4900	1268	2024-01-24_5d512b8c1ba51c2336e8da2eba3f1437_mafia.exe	85
PID 1268 wrote to memory of 4900	1268	2024-01-24_5d512b8c1ba51c2336e8da2eba3f1437_mafia.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-01-24_5d512b8c1ba51c2336e8da2eba3f1437_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-24_5d512b8c1ba51c2336e8da2eba3f1437_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Users\Admin\AppData\Local\Temp\7762.tmp
  "C:\Users\Admin\AppData\Local\Temp\7762.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-01-24_5d512b8c1ba51c2336e8da2eba3f1437_mafia.exe 24671D31F24DE256BD970890682715C2AC65701811E36365245A7F3E0FDBAFCDE319D2094A7DAE17B664AEB6A0749929F265E753D6C3729CAAB837256ECA30E2
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4900

C:\Users\Admin\AppData\Local\Temp\7762.tmp

Filesize
428KB

MD5
0b46f64a99eeb9b6ce8f2a14c42f2db2

SHA1
9f4fee93cae47ef895cbcc906f08fcb24a2b55c4

SHA256
7f00962f44bf3842251f1fbf1284b8a2de76c58a536b96f0c1efe930588f89e3

SHA512
ae7a0cb4d1266651274b1d7b6468d8ea7a24b5576d669b56ca830c2a87017ea96ee55ac35aff9122262a78d0bcb81a4d74e319c7e90696dfb5adcff7c1cc2610

Download Submit