Overview

overview

7

Static

static

3

2024-02-01...ia.exe

windows7-x64

7

2024-02-01...ia.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    01/02/2024, 20:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-02-01_38c981d65c6d0cb8c39db114188d8345_mafia.exe

  • Size

    486KB

  • MD5

    38c981d65c6d0cb8c39db114188d8345

  • SHA1

    75aa0b61fedf76f9a019a35d5c20ba7369e398c1

  • SHA256

    d558303a50e997804d66dbda00630c78d0c0e6e30d4511f089cc21adf64cfed2

  • SHA512

    62448e95b953e873ca617454d34df12d114dd980302729766a7d7248c7ab566ff5742480b30ff381721a004b6fc14930f5e19d3c93f8905be34a6d51171d9c98

  • SSDEEP

    12288:3O4rfItL8HPuxdwhKVuU2a0vnxKrCA+JwQA7rKxUYXhW:3O4rQtGP3KVMvorCvwT3KxUYXhW

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-01_38c981d65c6d0cb8c39db114188d8345_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-01_38c981d65c6d0cb8c39db114188d8345_mafia.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3040
    • C:\Users\Admin\AppData\Local\Temp\78F.tmp
      "C:\Users\Admin\AppData\Local\Temp\78F.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-01_38c981d65c6d0cb8c39db114188d8345_mafia.exe 1AD4CCD9229344D9A64AA12D934C99953591A97B1AD3CE0F6D993070B83339F05108406D04599D1D7F2856B702C66B09094E004561D710DD76AA71C0E579A12A
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:2224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\78F.tmp
    Filesize

    398KB

    MD5

    ac38c187d6f43fd98f8638042ea15103

    SHA1

    5acc29bb0e0ebc6bac3b6b2415bdea80e2f29482

    SHA256

    4f81ab80d38f4e5bf271a6f5c857b61ea1741baf6ab398529bf271e90a7e637d

    SHA512

    2ce0036734fbe835166686a4eb29465b9558eddaa85550dd8ce6d0e638fd0b3b63806c62c2225c460f882eb9d4d8aec6a16884ec7dd22ed1cce5cf1c4ed4988a

    Download Submit

  • \Users\Admin\AppData\Local\Temp\78F.tmp
    Filesize

    417KB

    MD5

    37bc6e8c412950c44f4f8f518b8f0f8e

    SHA1

    1d9ebde65904054f284134d4974139765361f346

    SHA256

    f08709811c8684da8f2ff005ab2a143752b72a890c7869ea82ff05a4cc600213

    SHA512

    dc74e263e3cb1d08795b9a0cae9fa44c68b19102fa07f37d36d96d24e471c32437a3455d1f266578cafda24b0d8ec598cee3dbe1c2a9b0a329ad6f4b2fa13798

    Download Submit