d517219e7b7096382c2c93b0542ed0fdc11fa48371ab354a2d9c9cddbd873d32

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2024, 22:50

Target
2024-03-25_cb6228a8021b3cb447f1c7666f090b8e_mafia.exe
Size 476KB
Sample240325-2spw8sae45
SHA256 d517219e7b7096382c2c93b0542ed0fdc11fa48371ab354a2d9c9cddbd873d32
MD5 cb6228a8021b3cb447f1c7666f090b8e
SHA1 755f734046049e11796e07289ed89d31954037f3
SHA512 650cf93b26d90d5a793fbff651dbd0b72dc48fbb2ad5f030f2ec8800fb32d91d0fff1ccf35a84d7e097ab0b57504be0a973ee57b11507252f81da6edadb499ef
SSDEEP 12288:aO4rfItL8HRZDg/O0OKuJDi0ZcqMRK5P7K9wlsDpVFd:aO4rQtGRZDg/HR4RV5P+9wlsDpVFd
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2488	706D.tmp

Executes dropped EXE 1 IoCs

pid	Process
2488	706D.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 2488	4464	2024-03-25_cb6228a8021b3cb447f1c7666f090b8e_mafia.exe	94
PID 4464 wrote to memory of 2488	4464	2024-03-25_cb6228a8021b3cb447f1c7666f090b8e_mafia.exe	94
PID 4464 wrote to memory of 2488	4464	2024-03-25_cb6228a8021b3cb447f1c7666f090b8e_mafia.exe	94

C:\Users\Admin\AppData\Local\Temp\2024-03-25_cb6228a8021b3cb447f1c7666f090b8e_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-25_cb6228a8021b3cb447f1c7666f090b8e_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Users\Admin\AppData\Local\Temp\706D.tmp
  "C:\Users\Admin\AppData\Local\Temp\706D.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-25_cb6228a8021b3cb447f1c7666f090b8e_mafia.exe DD6FF22F3992A9051590419B422DF6BDB419176B4FCF0926398D81C049D3988800C91C8B0C360B3836FB5BEFFBF5FA96D0883A43364DC39D06AA01B1D7A4CB3E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4116 --field-trial-handle=2260,i,11662483365823245381,11064702639240765741,262144 --variations-seed-version /prefetch:8
1⤵
PID:1360

706D.tmp

Path C:\Users\Admin\AppData\Local\Temp\706D.tmp
Size 476KB
SHA256 90414da2d300ec4fad2b74f6104fcbfbff9330fa475d399d0973bcf6f9cf1e63
MD5 cc6da45db2b212b0cf225dc9290d18bd
SHA1 a3b1b8889df29ec507f8e23ded64a4e28823ecc3
SHA512 9e2e3ad882247fa347eabd6ff09631c48d04d59c9129d58e28edb8a8337d4edad3b32ba331cdb9a145075d570a9e3be7d15dec9d89f851e3a27b8b2ef1eef568
SSDEEP 12288:aO4rfItL8HReCSD/PJbYyiORqQc7K9wlsDpVFd:aO4rQtGRejbJYtOjc+9wlsDpVFd
MD5 SHA1 SHA512 SSDEEP

Submit Download