894f756e3d1669a5c3d6f9a58a4c75f2e11fb0f1028c8d934c1500d2de9854d9

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 23:25

Target

2024-02-03_3e421927e8dd96f8ba869b31e7fbdc65_mafia.exe
Size

479KB
MD5

3e421927e8dd96f8ba869b31e7fbdc65
SHA1

f05c1cc1e72fe9fec058b34a1791f2bd34505978
SHA256

894f756e3d1669a5c3d6f9a58a4c75f2e11fb0f1028c8d934c1500d2de9854d9
SHA512

0288ec4a90f72809152f9e28a55766734a0f04825322d5479e1d64fe96e21e70621e623d830d75ff0e6c6abb03fefaf06af0f86c2524796f3e752d5a44cfa7ba
SSDEEP

12288:bO4rfItL8HAe/Gyy96oDao/xXhjaAr75UO:bO4rQtGAe/GR6IZXRXVUO

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1276	6E0C.tmp

Executes dropped EXE 1 IoCs

pid	Process
1276	6E0C.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 1276	3440	2024-02-03_3e421927e8dd96f8ba869b31e7fbdc65_mafia.exe	84
PID 3440 wrote to memory of 1276	3440	2024-02-03_3e421927e8dd96f8ba869b31e7fbdc65_mafia.exe	84
PID 3440 wrote to memory of 1276	3440	2024-02-03_3e421927e8dd96f8ba869b31e7fbdc65_mafia.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-02-03_3e421927e8dd96f8ba869b31e7fbdc65_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-03_3e421927e8dd96f8ba869b31e7fbdc65_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Users\Admin\AppData\Local\Temp\6E0C.tmp
  "C:\Users\Admin\AppData\Local\Temp\6E0C.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-03_3e421927e8dd96f8ba869b31e7fbdc65_mafia.exe DBF8F80159D932A0CEE2E09ECD32A002DD4752D1E898DD06CAEF6637F720255BCBD6481B715C2FC113E32F34BEEDBDBB6C29189FB1DBCBCA27AE256E12007D63
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1276

C:\Users\Admin\AppData\Local\Temp\6E0C.tmp

Filesize
479KB

MD5
31caa10cbe3b1f5d1ee45015539ed9c5

SHA1
bc533dcb40375c7cc287368376258cf3006eb7c1

SHA256
359b410184509c1d8f73eaedc4d81ad8716a094f7da6b27ff42f38dec62b3b90

SHA512
f50f21250497ba9acb25bbed190f223907e521d5558732c796c0865376df42abfd136f60962a8dbc7c02d2550df8529892bf86df5f07d485a2feb40a8c65972c

Download Submit