9f34d9b3965a68ed3d396e9b165f8414955d63e3d2d11ff6e2dea078113f465b

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 12:57

Target

2024-03-05_cbdf63fe8bd3413ade06122dd15636ff_mafia.exe
Size

476KB
MD5

cbdf63fe8bd3413ade06122dd15636ff
SHA1

ba1bea1f917ec300f0cdaf06233bdf1266978ce1
SHA256

9f34d9b3965a68ed3d396e9b165f8414955d63e3d2d11ff6e2dea078113f465b
SHA512

bab164f20d176b6d50aefcda2e9d0cfdca00ba25d8c6acd69584be9f11034334020c4a9fabefd879364647ab15260b0c92ab95c672083c91039d0cd1e766a8db
SSDEEP

12288:aO4rfItL8HR5bt5qigl0Zf9rzS+d7K9wlsDpVFd:aO4rQtGR5B5qzl0ZfNvd+9wlsDpVFd

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2004	2C0C.tmp

Executes dropped EXE 1 IoCs

pid	Process
2004	2C0C.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2004	2128	2024-03-05_cbdf63fe8bd3413ade06122dd15636ff_mafia.exe	99
PID 2128 wrote to memory of 2004	2128	2024-03-05_cbdf63fe8bd3413ade06122dd15636ff_mafia.exe	99
PID 2128 wrote to memory of 2004	2128	2024-03-05_cbdf63fe8bd3413ade06122dd15636ff_mafia.exe	99

C:\Users\Admin\AppData\Local\Temp\2024-03-05_cbdf63fe8bd3413ade06122dd15636ff_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-05_cbdf63fe8bd3413ade06122dd15636ff_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Users\Admin\AppData\Local\Temp\2C0C.tmp
  "C:\Users\Admin\AppData\Local\Temp\2C0C.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-05_cbdf63fe8bd3413ade06122dd15636ff_mafia.exe DAF723868C54B4F447F9049BC613E83ADCAD85461794D4EFC93787D7540E8DB53080D369D44741AB076F737B69E0A598B3DD43F5BD90A3E1276FF0616D337DB0
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4112 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:1632

C:\Users\Admin\AppData\Local\Temp\2C0C.tmp

Filesize
476KB

MD5
bee809be70ec4a7aef472ac6fc3199b4

SHA1
1fa4ce9a19f132b3d2deb3ca4c6d15a82d5c1f20

SHA256
b629bca733e4accc21b33c05b3acfdea7e4763307b3e8277943c63c28dc3c388

SHA512
d1a52cf4475bccbe06839792d55a285bd88ac475842d29aae959a6d4c763ec3514484588aee756a0b071369ada3ff0bed66c0f6d785f625192122fcd6154f219

Download Submit