18a40d8629259b28213b520d61cd14d66bbea4f3afe8aa645c92c5f839a8fe90

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 20:39

Target

2024-03-11_e56a779d03d2a6b6d0dbf4d06344cd3e_mafia.exe
Size

384KB
MD5

e56a779d03d2a6b6d0dbf4d06344cd3e
SHA1

5dbb6fb7592e2cd3c070161a122e31ad0a778eb9
SHA256

18a40d8629259b28213b520d61cd14d66bbea4f3afe8aa645c92c5f839a8fe90
SHA512

a440271c4558531e155ec0ad277fc5bbbe83d3b92d78005cb3c9ff00435b3196c86ff93b8097c032f4d4e164c2f2529932c6ad4990b61b5cfc592f05d6a07079
SSDEEP

6144:drxfv4co9ZL3GBGgjODxbf7hHC/rHaNKvcxtf4o/tGR+UvBDlLuNmz8aFaHjQU+Z:Zm48gODxbzqr6sU7bEwSDNRzOyZ

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3156	1170.tmp

Executes dropped EXE 1 IoCs

pid	Process
3156	1170.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 3156	3496	2024-03-11_e56a779d03d2a6b6d0dbf4d06344cd3e_mafia.exe	97
PID 3496 wrote to memory of 3156	3496	2024-03-11_e56a779d03d2a6b6d0dbf4d06344cd3e_mafia.exe	97
PID 3496 wrote to memory of 3156	3496	2024-03-11_e56a779d03d2a6b6d0dbf4d06344cd3e_mafia.exe	97

C:\Users\Admin\AppData\Local\Temp\2024-03-11_e56a779d03d2a6b6d0dbf4d06344cd3e_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-11_e56a779d03d2a6b6d0dbf4d06344cd3e_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Users\Admin\AppData\Local\Temp\1170.tmp
  "C:\Users\Admin\AppData\Local\Temp\1170.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-03-11_e56a779d03d2a6b6d0dbf4d06344cd3e_mafia.exe D7BE0ECBCC7611D8C916AE065F1FBD397FD0EFF4AA4E93793D2B9347E962466F78A7EB3159891306078D4658C1CB07D5BEFDA6B1897C5788E3E40EE854C5AE27
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3740 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:3128

C:\Users\Admin\AppData\Local\Temp\1170.tmp

Filesize
384KB

MD5
786c617b2e89247847705f0cb89772bb

SHA1
23d785800fb846d69349a86443fab2f8a636e4db

SHA256
2400632907c94d07a0c049a40257287e68d5032739acb2ad8e2836cc51b8a896

SHA512
abe3990a3e0c975bc65b93fa20e34595bc6939f1e436071d5513ef908e086679f79ec8bf0970b6839f6c82b45a62d59c3b01f73d2ad19610c33de2d95aea7104

Download Submit