Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
28-02-2024 04:32
General
-
Target
2024-02-28_1ff436aa66a1b2d9279dca8bc3a1398e_mafia.exe
-
Size
435KB
-
MD5
1ff436aa66a1b2d9279dca8bc3a1398e
-
SHA1
82a8378985227706238488507c3d977fff3fef3c
-
SHA256
336d42b2bf544b35fa610d77611b91f26c3542a139aae3a6f84d7d6a6cff493f
-
SHA512
a2591c8f2831aa502bf32bf473d05f3131247235d0d065cd83d6021c23b9765e8a2b7c47e016255ac92d5aa016a58971e59a1604a052409d720fc416314c84a3
-
SSDEEP
6144:fJvyW4ojUnQjx4qePix+qXQjBY+tkH3OBNe5Y7IxuJ22GQZ5+7NlwVJp3Lbc0fQQ:fd4x+ePixnXQjNkeBICPQuZ57BjfQwP
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-28_1ff436aa66a1b2d9279dca8bc3a1398e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-28_1ff436aa66a1b2d9279dca8bc3a1398e_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\600A.tmp"C:\Users\Admin\AppData\Local\Temp\600A.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-28_1ff436aa66a1b2d9279dca8bc3a1398e_mafia.exe 2F041EE3AC4F7C0251396C9082759930BC5A57085E8A86C8DEE65D01826B82B21B8FB292EC10E545247DAAD9F72016594B91E2F86E53493D09E82E83658DC57E2⤵
- Deletes itself
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
435KB
MD5703d7009f0d7efbb58cf9593475148c8
SHA1a42b3333cff783f86df0a011dce67555def70d23
SHA256f91e1b2d3ace5f9471852a9d190c5390982fec0296fac1af8ef8d9b17e515a0e
SHA512afec2ed57aa3d07b72368488c5fbda772d36b15bb67faa765e881d2809bbfe0cca86387644ee9de2ecdd463ccc8809a6c38bca1966f18521ea4f40802bde89a0