Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
25-03-2024 22:45
General
-
Target
2024-03-25_a5684da5fb004069a2b821a13f6197c6_mafia.exe
-
Size
428KB
-
MD5
a5684da5fb004069a2b821a13f6197c6
-
SHA1
3b9a8a9c2df369fcaf43b386142906e3bc16f726
-
SHA256
c5f4e78ff8add0f4c0636739e863a1461f9f29178e3675dc54388dcbeb1b157b
-
SHA512
e19ce28e9b7f4bed2c8aff3b2507e70dadeb1f75bedeba9b9e5d5e0f60b7d5a63e31b92ff6f681727827701f661f9a902ba541bd045767e28f2b81893f10e23c
-
SSDEEP
6144:gVdvczEb7GUOpYWhNVynE/mFhUHb8TOxgd3TXpSaiMGWcp2lluFddvmrqHR:gZLolhNVyE/IyxSTga7GWcwaddvYqHR
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-25_a5684da5fb004069a2b821a13f6197c6_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-25_a5684da5fb004069a2b821a13f6197c6_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4412.tmp"C:\Users\Admin\AppData\Local\Temp\4412.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-03-25_a5684da5fb004069a2b821a13f6197c6_mafia.exe B5A1A75D3E42D0F028853243215A1F464D6C5B1A1B22C0A79823506AD4EBE4DA3128DEF3EF2FABF1B959041CFFF83E54117EE633B89379D238DFEAAD85B69A692⤵
- Deletes itself
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
428KB
MD500dc1bf9e978cbdf5f4e2156eb53591b
SHA14f778c026eaef183613e6e0107632cc4dd47314b
SHA2561c58538607e8e36cc976329247aa1ac46718944991a1aad8b38c56545c3c0cc9
SHA5120e95cd53c357c38dde162f7213d538f52da58aaeb49fbc74d48bf8547e3d927b6019e534160c86a313aee136eb14d52b9f58e516a7c722f05a0faea9fc2298f4