9bac9bb51bbffb88de7b65365b8a8695879ade59c44ae4a02ae6facc2298c5e6

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 16:01

Target

2024-03-11_eec974c4e3f4391c8fc210593d81b63f_mafia.exe
Size

412KB
MD5

eec974c4e3f4391c8fc210593d81b63f
SHA1

32b0278df8624fb738aceb0654f0dbff2e196855
SHA256

9bac9bb51bbffb88de7b65365b8a8695879ade59c44ae4a02ae6facc2298c5e6
SHA512

7b45631f9ca9c589a1f744cd35d2193ed0106672b6e72a21f74cc939bc5d360e27b2f17f3811c001863fffbc891dc1e4dd1464c14fb9a9649e0f4fa2f0871bfc
SSDEEP

6144:UooTAQjKG3wDGAeIc9kphIoDZnBsLLVAi5wk/rTWAMcZDSqlBCvXKvq9QP:U6PCrIc9kph5kPVDaA1LBCv6vIo

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1796	33EC.tmp

Executes dropped EXE 1 IoCs

pid	Process
1796	33EC.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 1796	4464	2024-03-11_eec974c4e3f4391c8fc210593d81b63f_mafia.exe	96
PID 4464 wrote to memory of 1796	4464	2024-03-11_eec974c4e3f4391c8fc210593d81b63f_mafia.exe	96
PID 4464 wrote to memory of 1796	4464	2024-03-11_eec974c4e3f4391c8fc210593d81b63f_mafia.exe	96

C:\Users\Admin\AppData\Local\Temp\2024-03-11_eec974c4e3f4391c8fc210593d81b63f_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-11_eec974c4e3f4391c8fc210593d81b63f_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Users\Admin\AppData\Local\Temp\33EC.tmp
  "C:\Users\Admin\AppData\Local\Temp\33EC.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-03-11_eec974c4e3f4391c8fc210593d81b63f_mafia.exe 90DA4A3B0666B46782B08DE05E377C6F5BFAC398222CC50F67DD6F7AF30CB35A13F7C5763388803361788AFF9110C3EBB421D3C1C055FD738665C57103B5A057
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:3044

C:\Users\Admin\AppData\Local\Temp\33EC.tmp

Filesize
412KB

MD5
c445e8b61e7ac54a83decf020ae6bdb1

SHA1
03c182250c64d8a65cb48e077573050a641419f8

SHA256
72def38409fd2c6eb08be8afd9d46a17cf0c053ec9be62d78a42a06265dfcce2

SHA512
6dfdfcdc68985dce8a7e0aff54a801637e6bc1f409fa47143348764e020d7610b9a23ad47a021b2ccc58be52d7b8234816eb53b39d947640416439ba1b89cdcc

Download Submit