1ebed9b87f2254ebf45b685d3696b1da942a8de9e7a7a0395788055e84a037a0

Analysis

max time kernel
114s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-02-2024 21:38

Target

2024-02-27_f6eb5ad53d0d9958bdaa1995ce9ef342_mafia.exe
Size

473KB
MD5

f6eb5ad53d0d9958bdaa1995ce9ef342
SHA1

403de842c6b6a9e06357169b7948329d39082586
SHA256

1ebed9b87f2254ebf45b685d3696b1da942a8de9e7a7a0395788055e84a037a0
SHA512

626cc12753eb89eff2a34c86a938adbcc82b0ca47d5bba44c814edfae3625668c3da715acdaa42ef6e516b05626925e14d1932da7fd40b3419061d22b0c87511
SSDEEP

12288:Nb4bZudi79LNKEK9bMGwwy5r5srxqpKb2sJzfJA0a:Nb4bcdkLNKEK94GnyQxpPzfQ

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4604	6448.tmp

Executes dropped EXE 1 IoCs

pid	Process
4604	6448.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 4604	3920	2024-02-27_f6eb5ad53d0d9958bdaa1995ce9ef342_mafia.exe	93
PID 3920 wrote to memory of 4604	3920	2024-02-27_f6eb5ad53d0d9958bdaa1995ce9ef342_mafia.exe	93
PID 3920 wrote to memory of 4604	3920	2024-02-27_f6eb5ad53d0d9958bdaa1995ce9ef342_mafia.exe	93

C:\Users\Admin\AppData\Local\Temp\2024-02-27_f6eb5ad53d0d9958bdaa1995ce9ef342_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-27_f6eb5ad53d0d9958bdaa1995ce9ef342_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Users\Admin\AppData\Local\Temp\6448.tmp
  "C:\Users\Admin\AppData\Local\Temp\6448.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-27_f6eb5ad53d0d9958bdaa1995ce9ef342_mafia.exe 69FF404C183386B3648E2BB250241933C2B03873765BF3CBC020DB899E2B7B6220A62130EEA4F6A53B7ACE91C7B4F4C0E0CD61622274C380DCC88D2BCAD8FF33
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4124 --field-trial-handle=2256,i,18272763564106695635,11201593968620719822,262144 --variations-seed-version /prefetch:8
1⤵
PID:4060

C:\Users\Admin\AppData\Local\Temp\6448.tmp

Filesize
473KB

MD5
da84b4159bacfcd178f585fc6d4df8f1

SHA1
165ac89062046f923a0816cd3865aee896b9d96b

SHA256
d83e5184cd74053252de699f882007864bf36a72c5057b8ecbf0b125d17705de

SHA512
8eb19a8e42ac486d4025b3b2ae2a12f7ebbded96b6920776c0330159c2d0ab7aa08c8a9d29dac0665d8d70f7240d9eeec89720ebde668a581d8a46634ee2d4ca

Download Submit