Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
12-02-2024 17:38
General
-
Target
2024-02-12_6cfd4ea9ebfa6801cc4526ef9fc14462_mafia.exe
-
Size
444KB
-
MD5
6cfd4ea9ebfa6801cc4526ef9fc14462
-
SHA1
7b4fc74f95298cbcb1d0c8de973514c27606d584
-
SHA256
1c7d08034681e02161345587730824dde0c9f857cdbbd7b09c70c44aea3b721f
-
SHA512
a168fd382b103e557b850383c4726be45b4a3ba31ea8d0ad4023124a710d832fd00d00a4f87573cf57f9687d25e5a3390ccdfd2450085aa2ffbd402c712a87b4
-
SSDEEP
12288:Nb4bZudi79LeNIkp/gy/hszyD9GH/BnA:Nb4bcdkL6p/1OU9GHZ
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_6cfd4ea9ebfa6801cc4526ef9fc14462_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_6cfd4ea9ebfa6801cc4526ef9fc14462_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4856.tmp"C:\Users\Admin\AppData\Local\Temp\4856.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-12_6cfd4ea9ebfa6801cc4526ef9fc14462_mafia.exe 4D52C97C18301C8E328B3570409EB8E8A10EDD1C5BC802FB90F469FF3F08D5177F66E4F814E98F18A1FFCEAFF3D0303ED83437E866ABF62C059D72F5059B5C8D2⤵
- Deletes itself
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
444KB
MD5c30cb7232679258f495be41cdaa63075
SHA1430bf86eb0c9ed2dce1613370c532cb32e71bc21
SHA256693f4bf2a7a9c3a54575cd29da85161fb695de7bb4c9597d01b042b4df5e81c7
SHA512aa37d0446fe7ceaf18dfcb0aaa7f887e649a348790449b1e7cac1364b5f0225274eb7503059c40ff3013f5ba0c5bb8673f66f7743eaf019c76407bd6276e5b83