Analysis
-
max time kernel
95s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 15:35
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-25_5dc23b8b84759aa59bc5161fc47643fe_mafia.exe
Resource
win7-20231215-en
General
-
Target
2024-01-25_5dc23b8b84759aa59bc5161fc47643fe_mafia.exe
-
Size
486KB
-
MD5
5dc23b8b84759aa59bc5161fc47643fe
-
SHA1
3ec4b80cf40d74dcfe22e27d47301eb6350e4c9e
-
SHA256
3708304a2b568dc3d69188b706b2d04ec4233fa8bd0a85429e16864b5f5f8b3e
-
SHA512
3526ab5f9a4c718c30e2d52ff6c90984bcdc0b45e06c68e45fcdfba2806dc8d4cf82b9362544f73de9f2c58928ce4c6899de7bbba7e72695eef73bd69678c1bd
-
SSDEEP
12288:3O4rfItL8HPW78rJ0ECEEsrfyuQhCe1axg87rKxUYXhW:3O4rQtGPWQt0EdNrfFQhCSs3KxUYXhW
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
F9B2.tmppid process 5004 F9B2.tmp -
Executes dropped EXE 1 IoCs
Processes:
F9B2.tmppid process 5004 F9B2.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2024-01-25_5dc23b8b84759aa59bc5161fc47643fe_mafia.exedescription pid process target process PID 2532 wrote to memory of 5004 2532 2024-01-25_5dc23b8b84759aa59bc5161fc47643fe_mafia.exe F9B2.tmp PID 2532 wrote to memory of 5004 2532 2024-01-25_5dc23b8b84759aa59bc5161fc47643fe_mafia.exe F9B2.tmp PID 2532 wrote to memory of 5004 2532 2024-01-25_5dc23b8b84759aa59bc5161fc47643fe_mafia.exe F9B2.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_5dc23b8b84759aa59bc5161fc47643fe_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_5dc23b8b84759aa59bc5161fc47643fe_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"C:\Users\Admin\AppData\Local\Temp\F9B2.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-25_5dc23b8b84759aa59bc5161fc47643fe_mafia.exe 747562CA25E21B08A29450E44B38A669B2E6EFC54F9048A8AB1F502B1B6AE9A09552AED27C4A7282C63E9D85A266832A0C76F6945692C3037C12825DA3C270382⤵
- Deletes itself
- Executes dropped EXE
PID:5004
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\F9B2.tmpFilesize
486KB
MD5919a427f8d4ea97213b0039bf9d88117
SHA1db1ea7c21a3262d1bf2ff201101a1cc716fa13be
SHA256c0f21d685d015e036a6634ee199596cd01b7635240160d9b4762593a12865cbc
SHA51289718948360b0a2dc83ffb68c0986427baf836c7726e84d7fe79473ec6b037c5707e63bdc9f969e9de07d818d2471bf5a916c1a21ec36d477f3a16462d6ce531