Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    28/02/2024, 01:43

General

  • Target

    2024-02-28_0baf306dc83beb8b9860beb7d5ab9190_mafia.exe

  • Size

    384KB

  • MD5

    0baf306dc83beb8b9860beb7d5ab9190

  • SHA1

    afc73f7148da72dca8d9dbff5eb856de830cfb4b

  • SHA256

    403f6551424f3b464473e0893b927d531ad7d04225938c5a4813be9a62d594ef

  • SHA512

    35466fffad0d13d235e6d81090868f6ce3aba6f766f41d976dd9c708d9bb28a8700536d7967dade403ecfd1891b49ebeeb5e05dd0d09215e71de735817b527fa

  • SSDEEP

    6144:drxfv4co9ZL3GBGgjODxbf7hHc9ql4zHhUMl5F6HOTLyB1HCv7NAfCZ:Zm48gODxbzWkgBUqFkBFCv7NQCZ

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-28_0baf306dc83beb8b9860beb7d5ab9190_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-28_0baf306dc83beb8b9860beb7d5ab9190_mafia.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2192
    • C:\Users\Admin\AppData\Local\Temp\2B26.tmp
      "C:\Users\Admin\AppData\Local\Temp\2B26.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-02-28_0baf306dc83beb8b9860beb7d5ab9190_mafia.exe 033930DE879AE775C7CAF4EC98A3182CC75791B5DE6206ED7784773666EB66C5791D701997B9320C6A97DE864FE847F08713F33C46383AA4BCA2F2B4FB515B05
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:2188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\2B26.tmp

    Filesize

    384KB

    MD5

    4c428b01c90f1f3c13c2390600c7292b

    SHA1

    80b9cabb7375bbe2c85929de792e05b559f3ed73

    SHA256

    12eb925d49d19a4b868e41b6761e61fba107b034628bc2e609bb1b2e0f7c084b

    SHA512

    cdafee1a8935ff0df99bc84e7ea30020561f704f8d1ae6614287b1dccd715d62b49e05a3ad618c58a27a0eaaee84b9c1fa45f04a2097d4469388de65c715d515