2810836c72e5b068038059a373f2917fddd8e44836f22bb46cc7e98ec4886adc

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-03-2024 07:23

Target

2024-03-12_09d0230305b2ac6a568e7bd9c7139040_mafia.exe
Size

384KB
MD5

09d0230305b2ac6a568e7bd9c7139040
SHA1

712beca5a0be1fcb1614f9effb442714f6add16f
SHA256

2810836c72e5b068038059a373f2917fddd8e44836f22bb46cc7e98ec4886adc
SHA512

6682bc73081c31a885391c17f68eef61cc440ce25e2dd6a010ceb416f14da283e9609fc027b229497ff7b4c252c564d95b97be82250d393c76862ffc9a0aa41e
SSDEEP

6144:drxfv4co9ZL3GBGgjODxbf7hH5hNSqHKTBbhs6cqsCzwYpjtCZ:Zm48gODxbzv7SCKT5hjlEXZ

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3724	F1A3.tmp

Executes dropped EXE 1 IoCs

pid	Process
3724	F1A3.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 3724	2964	2024-03-12_09d0230305b2ac6a568e7bd9c7139040_mafia.exe	98
PID 2964 wrote to memory of 3724	2964	2024-03-12_09d0230305b2ac6a568e7bd9c7139040_mafia.exe	98
PID 2964 wrote to memory of 3724	2964	2024-03-12_09d0230305b2ac6a568e7bd9c7139040_mafia.exe	98

C:\Users\Admin\AppData\Local\Temp\2024-03-12_09d0230305b2ac6a568e7bd9c7139040_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-12_09d0230305b2ac6a568e7bd9c7139040_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Users\Admin\AppData\Local\Temp\F1A3.tmp
  "C:\Users\Admin\AppData\Local\Temp\F1A3.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-03-12_09d0230305b2ac6a568e7bd9c7139040_mafia.exe 5C1CD2D88CB8D6B0147781498E29181D39909D6484914C7788AE58CF39BA80AF5B99BD2EFAF36C102BD4654129A407C1536A57D50A665D8263FB56F4219B0C02
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3780 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:4428

C:\Users\Admin\AppData\Local\Temp\F1A3.tmp

Filesize
384KB

MD5
cd6e684e625a92cf18ca59ad98e598dc

SHA1
8451aff0b2630e702923d866ba2122bf3bbcd560

SHA256
dfce71792f2bb44f9adc926a46f0b3ca28b772acac54e30115f0c06ec7ae1b48

SHA512
cd3d9146d98a4c59c95705a55a266ce174a7bc9e7b4cf80eac219f23c26bbc63970df2239206e7f5d1c278420a1bc315fd0170b514e3dd079274b30bb07544e4

Download Submit