e1b81c140654fa12617c4354b21aecc967f32fbe23d10b9c55b4318e88ade8b3

Analysis

max time kernel
142s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-02-2024 20:44

Target

2024-02-28_917dce8bb69bd7ae96547846ba567bad_mafia.exe
Size

468KB
MD5

917dce8bb69bd7ae96547846ba567bad
SHA1

8f35b2388bd17162a6b5f5648b1f9f346c347f94
SHA256

e1b81c140654fa12617c4354b21aecc967f32fbe23d10b9c55b4318e88ade8b3
SHA512

18c544a85d248503316348f9ff7d50d945143f7cd09e8d07bd832c0f464675eed90c467547b72544d33a2ae969c9db70d97b7f73b2291690cd91104c3595eade
SSDEEP

12288:qO4rfItL8HGmBR74AFLwoG46oGt7J+F7bWmeEVGL:qO4rQtGGm7sAtwog6FumeEVGL

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2268	EA50.tmp

Executes dropped EXE 1 IoCs

pid	Process
2268	EA50.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 2268	4848	2024-02-28_917dce8bb69bd7ae96547846ba567bad_mafia.exe	97
PID 4848 wrote to memory of 2268	4848	2024-02-28_917dce8bb69bd7ae96547846ba567bad_mafia.exe	97
PID 4848 wrote to memory of 2268	4848	2024-02-28_917dce8bb69bd7ae96547846ba567bad_mafia.exe	97

C:\Users\Admin\AppData\Local\Temp\2024-02-28_917dce8bb69bd7ae96547846ba567bad_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-28_917dce8bb69bd7ae96547846ba567bad_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Users\Admin\AppData\Local\Temp\EA50.tmp
  "C:\Users\Admin\AppData\Local\Temp\EA50.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-28_917dce8bb69bd7ae96547846ba567bad_mafia.exe 10F940FD58D16611E2B81C3F1CC5F4BBCA434BC59CA094FE82EB742296DE46CB900BBBB7C875B74545BFCACAFAEB5ECEA183D9752E1C14B1A841E485C2153A3C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4064 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:2344

C:\Users\Admin\AppData\Local\Temp\EA50.tmp

Filesize
468KB

MD5
f72bcca04b560adf78374bbc6e1df308

SHA1
7a54d5f6d4805d6e8513dddda67bd0953bd90962

SHA256
cc82a825367989ef936c40afecade8531419ebe753e9c81fd68f8818159df979

SHA512
8057b30d06def42c228d577b8ccd630c5b2495bb2478bf8e0f053c55ab6a5c3ad766d2bc89e7c508a82edd017296468bfda735dabb1062e92f32e1073f708d73

Download Submit