aa0c156df6e2d28664c9d553c1bf3848cfb74d8d72d2a5b8c97b22958a6f5e19

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 23:36

Target

2024-03-19_83687ec0fa0d42d2b9371ca2f8456132_mafia.exe
Size

443KB
MD5

83687ec0fa0d42d2b9371ca2f8456132
SHA1

4cb4065e5526a5cb58cc3d02395eb6b1f19630bd
SHA256

aa0c156df6e2d28664c9d553c1bf3848cfb74d8d72d2a5b8c97b22958a6f5e19
SHA512

052a5040759cc822dfd1e591c3536a8bcdc1bcd2e4e8bc66845ad92a26ae0867187245aaa4eb4cca333cf281138b0eb2ce248ecfbd11234c755b7b0a7d20f3f5
SSDEEP

12288:Wq4w/ekieZgU6U7H3fGI4ohav1kuxpBDYp28lMa:Wq4w/ekieH6U7Xf4wq7cp9P

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3528	613A.tmp

Executes dropped EXE 1 IoCs

pid	Process
3528	613A.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 3528	1988	2024-03-19_83687ec0fa0d42d2b9371ca2f8456132_mafia.exe	95
PID 1988 wrote to memory of 3528	1988	2024-03-19_83687ec0fa0d42d2b9371ca2f8456132_mafia.exe	95
PID 1988 wrote to memory of 3528	1988	2024-03-19_83687ec0fa0d42d2b9371ca2f8456132_mafia.exe	95

C:\Users\Admin\AppData\Local\Temp\2024-03-19_83687ec0fa0d42d2b9371ca2f8456132_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-19_83687ec0fa0d42d2b9371ca2f8456132_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Users\Admin\AppData\Local\Temp\613A.tmp
  "C:\Users\Admin\AppData\Local\Temp\613A.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-19_83687ec0fa0d42d2b9371ca2f8456132_mafia.exe 5594091358101407596305C039A30EEB9AA7DAF0E48CCDF5851CAE3E540EC5F65124FF03741071E9C829171F6D12749C3E1CAB72CE1F19D4871870E365E77F0D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3816 --field-trial-handle=2496,i,15897292497548307209,13920214570023230813,262144 --variations-seed-version /prefetch:8
1⤵
PID:4404

C:\Users\Admin\AppData\Local\Temp\613A.tmp

Filesize
443KB

MD5
6fb2d4e6c2085b96ed9e9c0d1126872e

SHA1
0a79738426af9e7a97c60c22f69954f4bcac2312

SHA256
c1305fd8084f4ceee2817fc7f700f331f36560859a0d26d0919d97b1772b3e69

SHA512
80616daad9167412fab3addbfba2d5132c051249e7892d59de1bf228bc140f358e07bdb17a985a77d6ba9ed3947737bb68edd74b0e3e566394857acb9f04137d

Download Submit