314be1cf70b6c6ec0995bac34b40b2c7485459f07826af85504a9418078d3a7d

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-03-2024 08:22

Target

2024-03-19_05e03642646c5cdaf2f6afad15d31be7_mafia.exe
Size

412KB
MD5

05e03642646c5cdaf2f6afad15d31be7
SHA1

1ba4b8ee8c4729606edd409948bbc69464ebdae6
SHA256

314be1cf70b6c6ec0995bac34b40b2c7485459f07826af85504a9418078d3a7d
SHA512

2e3b20e06468c43a63f6e5daaaf256b549d40ab1fa76ad84e5f027748cb9808caa35f69ada89b3f619440c789e8c21a83602f147d28c6da26085d5353f5331fb
SSDEEP

6144:UooTAQjKG3wDGAeIc9kphIoDZn78GZ599OwycHEHhvTIN9/lIS3swy8+CJMP:U6PCrIc9kph5J8UP9Ofof9//q

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4348	2304.tmp

Executes dropped EXE 1 IoCs

pid	Process
4348	2304.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 4348	4492	2024-03-19_05e03642646c5cdaf2f6afad15d31be7_mafia.exe	95
PID 4492 wrote to memory of 4348	4492	2024-03-19_05e03642646c5cdaf2f6afad15d31be7_mafia.exe	95
PID 4492 wrote to memory of 4348	4492	2024-03-19_05e03642646c5cdaf2f6afad15d31be7_mafia.exe	95

C:\Users\Admin\AppData\Local\Temp\2024-03-19_05e03642646c5cdaf2f6afad15d31be7_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-19_05e03642646c5cdaf2f6afad15d31be7_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Users\Admin\AppData\Local\Temp\2304.tmp
  "C:\Users\Admin\AppData\Local\Temp\2304.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-03-19_05e03642646c5cdaf2f6afad15d31be7_mafia.exe DFA62683437AD7081A44E7B2F89312972CF33D1C617A2AC1840AEBADE974618376D54508F6941EBBD1B2E3D0B05197BAF2B9223E036F6BB76289C0EE96F55AEA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:3192

C:\Users\Admin\AppData\Local\Temp\2304.tmp

Filesize
412KB

MD5
f992840c765ae6edd7698142ee071fb2

SHA1
d88fd970f5fc4906685d5ccd7aa892c1e224a77d

SHA256
313351b6e6552db42ba9f71aa7c64155fb1e44a9a6c085b3ae33dab42d50d232

SHA512
176ae7facedbdd48426c0e6636e98325417be345f7963db89f6bcf5b6440a689d4a72d1df683ad0c6735d2bd54fb529c93098bb385812b47e48aecaffd5580d9

Download Submit