Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
13/02/2024, 18:52
General
-
Target
2024-02-13_f6ab0b715946be012f58cd543729d2d1_mafia.exe
-
Size
479KB
-
MD5
f6ab0b715946be012f58cd543729d2d1
-
SHA1
483bdd85a92a583beca50cfef8d8747b7cb1734a
-
SHA256
86ea3c75f6dee82c194302e4c96e201c8070a2ee8a7171562ac69eed621d79b5
-
SHA512
a91d5d5c1415c025a23f9eb658f9147bbb191529485d9aa21b2a8f1b9d8d3db77ba802ca96206fc848345703903d78bbdea1344271f1a9c307730cc17a5b87af
-
SSDEEP
6144:b9EyS4oMxIkjxcWqHtg88HARRiLpbYEydGMQXL+fnr6UZOa3ZnU1bAvrJle1kP7z:bO4rfItL8HA6LpbYbBDOyZnUm175UO
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-13_f6ab0b715946be012f58cd543729d2d1_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-13_f6ab0b715946be012f58cd543729d2d1_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5F40.tmp"C:\Users\Admin\AppData\Local\Temp\5F40.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-13_f6ab0b715946be012f58cd543729d2d1_mafia.exe 681FFF6934F6B9E8177A75423F43321624AC65D26780D1ECC239D73578CA9F44F9C56DD8D858897833370C036BC2FB342006167A5844E97C302A9BBA03145D842⤵
- Deletes itself
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
479KB
MD580a0eaae94d639dc57022b279cbf537d
SHA11bb94543b6cf3009295dfaf6f6a706de3f8b8102
SHA256aaa78f21be09579b9c24a95a5345a8766e2780e4a537775129c7f553116387c1
SHA51239cdf24c90c49bf7eb3a2647f784cefd66623a2a4988b30c34e2f6718ab4f59bba46f8c65ec2a2798d1df3472b9b1df1d2b61f4853df6e02c16cc84ac6929a00