Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
25-01-2024 16:33
General
-
Target
2024-01-25_523f9638ad0c2c3d6429486e7166b867_mafia.exe
-
Size
433KB
-
MD5
523f9638ad0c2c3d6429486e7166b867
-
SHA1
699c71c8af8b8cdf8fb067ad26ce958c62ab4b1d
-
SHA256
1eae209c46e192db0ac7fee91e98441da340335f7fd6c26537932473b214c729
-
SHA512
ad64fd7259b1b449ec46f19d15b4ebe4db192703890a05ab988d5ab552f08194b1fdcdb88a3a6bdbfc127dac8499387692c54dbcfd7184a709951c427316960c
-
SSDEEP
12288:Ci4g+yU+0pAiv+OLF7xfxzLw5ZDdyG/rGmn:Ci4gXn0pD+a7xfx459dlr9
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_523f9638ad0c2c3d6429486e7166b867_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_523f9638ad0c2c3d6429486e7166b867_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5300.tmp"C:\Users\Admin\AppData\Local\Temp\5300.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-25_523f9638ad0c2c3d6429486e7166b867_mafia.exe 080118840D48E0259A11085750D18D5A1D775D402666D6BF48B34D6E01002E51B0B57B2AA40BD444427CEB61C1F0D42002A9C4888ED25A269CC46A2724C057172⤵
- Deletes itself
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\5300.tmpFilesize
433KB
MD5bad4e404c0714ee281fb552c16af7ad9
SHA15904003bde18aa758afc985352834085261a2cab
SHA256b92b9b2b9a374121322f7877256ea0e259cd1340d0ac5e975bd1cccf69e7f8fa
SHA512f2a93614494434df892c8a28e7ea858e749a25e7e8cc6e52d24dfd704f42f9d944e35091c7328b0f55aa0545518c9f44a5bdfcb62ce16c31814c5248de12d6c3