2125fb57cc494e397b6221549a4a2f6417532dcc50ef7a369079c1e81196d27c

Analysis

max time kernel
138s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 23:43

Target

2024-03-26_ac2f8babf3ac29ed70b326f019590111_mafia.exe
Size

384KB
MD5

ac2f8babf3ac29ed70b326f019590111
SHA1

71639e20728ab3efdf0b4f2ab8b975eec812b997
SHA256

2125fb57cc494e397b6221549a4a2f6417532dcc50ef7a369079c1e81196d27c
SHA512

018008f888f3a385e5f819553b1a3995d0e76d52c32a799246ed60eec4f19fb4410052da4bd394ded0e42d8ccc2bd498f34ac8f48cd4a633f3339f4970e180e5
SSDEEP

6144:drxfv4co9ZL3GBGgjODxbf7hH/dUjG/nO6001DMx9t+tFHPHdfX8GE1E0DJYrXts:Zm48gODxbzY4nO6001DMItFFfMGE19mS

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2828	6820.tmp

Executes dropped EXE 1 IoCs

pid	Process
2828	6820.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 2828	5020	2024-03-26_ac2f8babf3ac29ed70b326f019590111_mafia.exe	95
PID 5020 wrote to memory of 2828	5020	2024-03-26_ac2f8babf3ac29ed70b326f019590111_mafia.exe	95
PID 5020 wrote to memory of 2828	5020	2024-03-26_ac2f8babf3ac29ed70b326f019590111_mafia.exe	95

C:\Users\Admin\AppData\Local\Temp\2024-03-26_ac2f8babf3ac29ed70b326f019590111_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-26_ac2f8babf3ac29ed70b326f019590111_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Users\Admin\AppData\Local\Temp\6820.tmp
  "C:\Users\Admin\AppData\Local\Temp\6820.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-03-26_ac2f8babf3ac29ed70b326f019590111_mafia.exe B31FEB41D68ABDE97FC149BFEA9920D32E609393B863593E4F94956CEA18E0DF68BDAAB88C2B4E6C013AE35B0D20A87DF8878968B28BB334C6AB291D943D3CEF
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3928 --field-trial-handle=2256,i,9172343514068348080,519219714517961765,262144 --variations-seed-version /prefetch:8
1⤵
PID:3180

C:\Users\Admin\AppData\Local\Temp\6820.tmp

Filesize
384KB

MD5
06504e0536428e4a1eba754e256fe8bc

SHA1
b743e2a14329eb6b9d734447c11c7b3fd401a13d

SHA256
6787bd79e948dca4939ca7e249d66db3255ae1637a0f3696d6628c0fc0627e6e

SHA512
7483a293e33ba3469f763d820f0b70166174f45bf8a6686b2e420f6ed3f40f4444b54022083b2922078d48d1378aa0034431ecfd7f9b90983a2bfc1f7a082913

Download Submit