Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
25-01-2024 15:35
General
-
Target
2024-01-25_5dc23b8b84759aa59bc5161fc47643fe_mafia.exe
-
Size
486KB
-
MD5
5dc23b8b84759aa59bc5161fc47643fe
-
SHA1
3ec4b80cf40d74dcfe22e27d47301eb6350e4c9e
-
SHA256
3708304a2b568dc3d69188b706b2d04ec4233fa8bd0a85429e16864b5f5f8b3e
-
SHA512
3526ab5f9a4c718c30e2d52ff6c90984bcdc0b45e06c68e45fcdfba2806dc8d4cf82b9362544f73de9f2c58928ce4c6899de7bbba7e72695eef73bd69678c1bd
-
SSDEEP
12288:3O4rfItL8HPW78rJ0ECEEsrfyuQhCe1axg87rKxUYXhW:3O4rQtGPWQt0EdNrfFQhCSs3KxUYXhW
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_5dc23b8b84759aa59bc5161fc47643fe_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_5dc23b8b84759aa59bc5161fc47643fe_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-25_5dc23b8b84759aa59bc5161fc47643fe_mafia.exe ED1B9D8B977092518DD5428BB0B86583170F32CBA14EFA45F68324E3DE27B750D8C54E189E5302D7E39A0F97D918D03894B0B88B037FED3FE232CF25530A5C892⤵
- Deletes itself
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\5052.tmpFilesize
486KB
MD5616639277d713738c22fab5d107b3e5e
SHA13c6eb355c8433e0b56cc4dd491f95c139deb8ead
SHA256bef8d6383be9398aca9c0db4402310190c9725a6c163f36b15195fe91d71f38a
SHA5123176f6b18e072d56e965c6082b4e08d7ad33e93bea1a351e87e98fc5242a9538d419289488cc922c556d4f35b84283030df60580a5aa34418fda520a16d7fdc3