Analysis
-
max time kernel
144s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12-02-2024 17:38
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-12_6cfd4ea9ebfa6801cc4526ef9fc14462_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-12_6cfd4ea9ebfa6801cc4526ef9fc14462_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-12_6cfd4ea9ebfa6801cc4526ef9fc14462_mafia.exe
-
Size
444KB
-
MD5
6cfd4ea9ebfa6801cc4526ef9fc14462
-
SHA1
7b4fc74f95298cbcb1d0c8de973514c27606d584
-
SHA256
1c7d08034681e02161345587730824dde0c9f857cdbbd7b09c70c44aea3b721f
-
SHA512
a168fd382b103e557b850383c4726be45b4a3ba31ea8d0ad4023124a710d832fd00d00a4f87573cf57f9687d25e5a3390ccdfd2450085aa2ffbd402c712a87b4
-
SSDEEP
12288:Nb4bZudi79LeNIkp/gy/hszyD9GH/BnA:Nb4bcdkL6p/1OU9GHZ
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
4FE5.tmppid process 2440 4FE5.tmp -
Executes dropped EXE 1 IoCs
Processes:
4FE5.tmppid process 2440 4FE5.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2024-02-12_6cfd4ea9ebfa6801cc4526ef9fc14462_mafia.exedescription pid process target process PID 2588 wrote to memory of 2440 2588 2024-02-12_6cfd4ea9ebfa6801cc4526ef9fc14462_mafia.exe 4FE5.tmp PID 2588 wrote to memory of 2440 2588 2024-02-12_6cfd4ea9ebfa6801cc4526ef9fc14462_mafia.exe 4FE5.tmp PID 2588 wrote to memory of 2440 2588 2024-02-12_6cfd4ea9ebfa6801cc4526ef9fc14462_mafia.exe 4FE5.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_6cfd4ea9ebfa6801cc4526ef9fc14462_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_6cfd4ea9ebfa6801cc4526ef9fc14462_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-12_6cfd4ea9ebfa6801cc4526ef9fc14462_mafia.exe 63CAD875220D26AC44CE1E9D15668C26C396A40ADCE3A693F0FFE5E1DAE81A52646364E967068E286D37ABA769B663938494F02E19580D1D0A27D63662B390162⤵
- Deletes itself
- Executes dropped EXE
PID:2440
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
444KB
MD54788aa8158fee5d89c0218964f44dbb0
SHA14f31ff35f52a76c65900c6b93863f0425e2be7f2
SHA2565e5a1114c4bab14d3036383dbc3ace1f58d3806ecc9a7a7bc0b2b52645cbbf49
SHA51206ad54fbbec21c0bbf34ca12dbf009d6de460955eb3ba33dbabc930cb5c7751ce6dd23df55def26dc9b7560b111dc38eb5e1793f91f62cc1c4f8d2a7ac2bffed