6a01660c3577b31ea60eb02967e4215f7899755e1cba92dfb0679ba4827b8f35

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-02-2024 05:10

Target

2024-02-28_88f941bddcd8deffadbe8744e44895d3_mafia.exe
Size

384KB
MD5

88f941bddcd8deffadbe8744e44895d3
SHA1

308ba78e5b7bafd0c4799b6ec667889d36adbe1a
SHA256

6a01660c3577b31ea60eb02967e4215f7899755e1cba92dfb0679ba4827b8f35
SHA512

d8063acfab0999fae3d632edcae1498c9b66123aa106cef54d5db0eb91e38b7b709a0df09aa21a62d6201391c736ca4135f524112305512727a0d16fd6ba5e90
SSDEEP

6144:drxfv4co9ZL3GBGgjODxbf7hHtWXfoudKOVyg3vMfxSJBxmEXsePyO2jGaQHzuZ:Zm48gODxbz6AuZm8VZXseaORTuZ

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3484	C61F.tmp

Executes dropped EXE 1 IoCs

pid	Process
3484	C61F.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 3484	5004	2024-02-28_88f941bddcd8deffadbe8744e44895d3_mafia.exe	98
PID 5004 wrote to memory of 3484	5004	2024-02-28_88f941bddcd8deffadbe8744e44895d3_mafia.exe	98
PID 5004 wrote to memory of 3484	5004	2024-02-28_88f941bddcd8deffadbe8744e44895d3_mafia.exe	98

C:\Users\Admin\AppData\Local\Temp\2024-02-28_88f941bddcd8deffadbe8744e44895d3_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-28_88f941bddcd8deffadbe8744e44895d3_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Users\Admin\AppData\Local\Temp\C61F.tmp
  "C:\Users\Admin\AppData\Local\Temp\C61F.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-02-28_88f941bddcd8deffadbe8744e44895d3_mafia.exe E07517D2FF1A62ADD7155CEFADB43A288D17E88EF1A143DCE48B2A8D402254FCD3EAB6EF4F66F67902673FB83C4637CEF94731D796F13E9BCC59A596723C4AC1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2808 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:3956

C:\Users\Admin\AppData\Local\Temp\C61F.tmp

Filesize
384KB

MD5
a1f5c7fdfdd139fa3f1150b3d6cb16eb

SHA1
5fddfc8191898c080f2bc2f28b4aae73476aeeca

SHA256
a8c174cf67e06638d0e264a8cd06969f03dc2b930e8ca8f673ecf43e4f71b816

SHA512
382dd2c2ed6e56cab1bfe1a3f13cb7129e19ed66f45f74242edb7af0c0634468e9443fd3fa4b1b156b226f5916605a9ee2dedfc3c8f8d5d93f9c2f7b841861f0

Download Submit