Resubmissions

19-02-2024 13:19

240219-qkrkbadh67 10

19-02-2024 13:03

240219-qata6adh35 10

Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-02-2024 13:03

General

  • Target

    2024-02-19_a81cc3fe0573a35d45da42efccac1c3c_mafia.exe

  • Size

    3.0MB

  • MD5

    a81cc3fe0573a35d45da42efccac1c3c

  • SHA1

    dac1f594d36a142247921aeee83973e16315172b

  • SHA256

    9c0ab62f30e4b8adab8275cbebadfff17470b705f8413ba454b79bf120b46060

  • SHA512

    0baa5e7005624bb1ac0b7163972b425e120bdd2a1c4dd7c539ae30ca8172ecf9ef6859282dd8d600776d31dd23213a42ae6a4774280ba36820a6a6a61cf898f7

  • SSDEEP

    24576:1mukpwHRveBrysA+XJNE91VkUnDoX1VKA2EqRZlh9amp:sukqxvLsA+X/E91VHnDoX1niRZlh9T

Score
10/10

Malware Config

Signatures

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

  • Program crash 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-19_a81cc3fe0573a35d45da42efccac1c3c_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-19_a81cc3fe0573a35d45da42efccac1c3c_mafia.exe"
    1⤵
      PID:3908
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 904
        2⤵
        • Program crash
        PID:2312
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 888
        2⤵
        • Program crash
        PID:2344
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 988
        2⤵
        • Program crash
        PID:4756
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3908 -ip 3908
      1⤵
        PID:4784
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3908 -ip 3908
        1⤵
          PID:4736
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3908 -ip 3908
          1⤵
            PID:2908

          Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads