Analysis

  • max time kernel
    139s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-02-2024 17:52

General

  • Target

    2024-02-12_dada41e3335d946f7687f9fe4820e9d3_mafia.exe

  • Size

    486KB

  • MD5

    dada41e3335d946f7687f9fe4820e9d3

  • SHA1

    dce7840f92630f464941aa26bf3c2b5be04eb7c6

  • SHA256

    4bdfbe867c70423426fe46b02486dc2db7ea2914f4c62c28a5775c9a64985842

  • SHA512

    47237b669e476f02a3c927fbf492e5f19fd2db035a311582c37d1ed91773f8acfdfce01374d30a098fcea434cec7ba2ff0491a0c4a5f4d71a92dab079efaadf0

  • SSDEEP

    12288:3O4rfItL8HPS8KYSGNhSBQ99idWwp/CT7rKxUYXhW:3O4rQtGPS8KYSGNcRJs3KxUYXhW

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-12_dada41e3335d946f7687f9fe4820e9d3_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-12_dada41e3335d946f7687f9fe4820e9d3_mafia.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1388
    • C:\Users\Admin\AppData\Local\Temp\EA7F.tmp
      "C:\Users\Admin\AppData\Local\Temp\EA7F.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-12_dada41e3335d946f7687f9fe4820e9d3_mafia.exe D3C3AE0BE7FD7272461BB3B56C35C96F1CA119177DA515EABE5CDFD0056B028FD8E8C1709B8A78E945516BA87C53F0FADCEE6900F8844E2F43FD54591E5772A4
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:872

Network

  • flag-us
    DNS
    97.17.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.17.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    209.78.101.95.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    209.78.101.95.in-addr.arpa
    IN PTR
    Response
    209.78.101.95.in-addr.arpa
    IN PTR
    a95-101-78-209deploystaticakamaitechnologiescom
  • flag-us
    DNS
    4.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    4.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    50.23.12.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    50.23.12.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    198.187.3.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    198.187.3.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    217.135.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.135.221.88.in-addr.arpa
    IN PTR
    Response
    217.135.221.88.in-addr.arpa
    IN PTR
    a88-221-135-217deploystaticakamaitechnologiescom
  • flag-us
    DNS
    178.223.142.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    178.223.142.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    208.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    208.178.17.96.in-addr.arpa
    IN PTR
    Response
    208.178.17.96.in-addr.arpa
    IN PTR
    a96-17-178-208deploystaticakamaitechnologiescom
  • flag-us
    DNS
    31.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    31.243.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    31.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    31.243.111.52.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    31.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    31.243.111.52.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    198.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    198.178.17.96.in-addr.arpa
    IN PTR
    Response
    198.178.17.96.in-addr.arpa
    IN PTR
    a96-17-178-198deploystaticakamaitechnologiescom
  • flag-us
    DNS
    89.16.208.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    89.16.208.104.in-addr.arpa
    IN PTR
    Response
  • 20.231.121.79:80
    260 B
    5
  • 8.8.8.8:53
    97.17.167.52.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    97.17.167.52.in-addr.arpa

  • 8.8.8.8:53
    209.78.101.95.in-addr.arpa
    dns
    72 B
    137 B
    1
    1

    DNS Request

    209.78.101.95.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    4.159.190.20.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    4.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    50.23.12.20.in-addr.arpa
    dns
    140 B
    156 B
    2
    1

    DNS Request

    50.23.12.20.in-addr.arpa

    DNS Request

    50.23.12.20.in-addr.arpa

  • 8.8.8.8:53
    198.187.3.20.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    198.187.3.20.in-addr.arpa

  • 8.8.8.8:53
    217.135.221.88.in-addr.arpa
    dns
    73 B
    139 B
    1
    1

    DNS Request

    217.135.221.88.in-addr.arpa

  • 8.8.8.8:53
    178.223.142.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    178.223.142.52.in-addr.arpa

  • 8.8.8.8:53
    208.178.17.96.in-addr.arpa
    dns
    72 B
    137 B
    1
    1

    DNS Request

    208.178.17.96.in-addr.arpa

  • 8.8.8.8:53
    31.243.111.52.in-addr.arpa
    dns
    216 B
    158 B
    3
    1

    DNS Request

    31.243.111.52.in-addr.arpa

    DNS Request

    31.243.111.52.in-addr.arpa

    DNS Request

    31.243.111.52.in-addr.arpa

  • 8.8.8.8:53
    198.178.17.96.in-addr.arpa
    dns
    72 B
    137 B
    1
    1

    DNS Request

    198.178.17.96.in-addr.arpa

  • 8.8.8.8:53
    89.16.208.104.in-addr.arpa
    dns
    72 B
    146 B
    1
    1

    DNS Request

    89.16.208.104.in-addr.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\EA7F.tmp

    Filesize

    486KB

    MD5

    c52704b1c593ea83a3287bb134c8d329

    SHA1

    4fa256ef98844fa17886efe82c7171de951ff5e7

    SHA256

    7b09c78ddfe62da368d9007c0b6b4cd3bc58797ed008e7b282ebca49ee462aa6

    SHA512

    de2786dd9e4cc5554f78c3e67575249ebcf4c1b8cf3f44df12c2e83e2f77d5bb44eea865ed367da78746e634e249cac1cf61f3d9c47cdc6fc2f0ef624f45fc68

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.