Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19-02-2024 13:03
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-19_a81cc3fe0573a35d45da42efccac1c3c_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-19_a81cc3fe0573a35d45da42efccac1c3c_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-19_a81cc3fe0573a35d45da42efccac1c3c_mafia.exe
-
Size
3.0MB
-
MD5
a81cc3fe0573a35d45da42efccac1c3c
-
SHA1
dac1f594d36a142247921aeee83973e16315172b
-
SHA256
9c0ab62f30e4b8adab8275cbebadfff17470b705f8413ba454b79bf120b46060
-
SHA512
0baa5e7005624bb1ac0b7163972b425e120bdd2a1c4dd7c539ae30ca8172ecf9ef6859282dd8d600776d31dd23213a42ae6a4774280ba36820a6a6a61cf898f7
-
SSDEEP
24576:1mukpwHRveBrysA+XJNE91VkUnDoX1VKA2EqRZlh9amp:sukqxvLsA+X/E91VHnDoX1niRZlh9T
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2312 3908 WerFault.exe 2024-02-19_a81cc3fe0573a35d45da42efccac1c3c_mafia.exe 2344 3908 WerFault.exe 2024-02-19_a81cc3fe0573a35d45da42efccac1c3c_mafia.exe 4756 3908 WerFault.exe 2024-02-19_a81cc3fe0573a35d45da42efccac1c3c_mafia.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-19_a81cc3fe0573a35d45da42efccac1c3c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-19_a81cc3fe0573a35d45da42efccac1c3c_mafia.exe"1⤵PID:3908
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 9042⤵
- Program crash
PID:2312 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 8882⤵
- Program crash
PID:2344 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 9882⤵
- Program crash
PID:4756
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3908 -ip 39081⤵PID:4784
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3908 -ip 39081⤵PID:4736
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3908 -ip 39081⤵PID:2908