Analysis
-
max time kernel
147s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
01-03-2024 01:05
General
-
Target
2024-03-01_b53623b53e86c389e7f0694f91221443_mafia.exe
-
Size
965KB
-
MD5
b53623b53e86c389e7f0694f91221443
-
SHA1
dc6c595f5a14de28161ab0c3523f4320109242ab
-
SHA256
c7d57b7d0289e352b064ea184222367ec3001d38075c9fe73662daa90dabbdfb
-
SHA512
6462cd1c5ed116fa2e789fc162474225b44382b2defc8ee21effcd731e04b686055b4e682505700a3f02a9823ddf2feedad649d2009a3ba88b168b5a9e46de9f
-
SSDEEP
12288:BLBjmLuKAu8kkGP6lmg4tkpKh2kvmUzLc1DQAgQyXfZjSrySEsZx62U9rrc5kBq9:ouBmDT2ovcpyfxsZxh5SqHhT
Score
10/10
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-01_b53623b53e86c389e7f0694f91221443_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-01_b53623b53e86c389e7f0694f91221443_mafia.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses