cb88ec43bb76f18918c2f5ec08b395bc6df9907b73e5426f45300760cf537ba0

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 06:42

Target

2024-03-26_959bc0b26a5317e31fb1870c14be0323_mafia.exe
Size

384KB
MD5

959bc0b26a5317e31fb1870c14be0323
SHA1

f94912f0ce4d97789afbe89f7d4557200b0e99ca
SHA256

cb88ec43bb76f18918c2f5ec08b395bc6df9907b73e5426f45300760cf537ba0
SHA512

ffbdb6ccdd5b738b5b2be87d3c14a2660c0ce946f046a9128f82cc2ac9fbaddf73cbdb915284cb2dcea4fe1b2a8770d0affadf8261cc1608aea3c5263fca168c
SSDEEP

6144:drxfv4co9ZL3GBGgjODxbf7hH+qOkGNrGmJFqbj0kwb8UpzXwl1aZ:Zm48gODxbzAZkifqsnpklkZ

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1904	66C8.tmp

Executes dropped EXE 1 IoCs

pid	Process
1904	66C8.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 1904	3436	2024-03-26_959bc0b26a5317e31fb1870c14be0323_mafia.exe	95
PID 3436 wrote to memory of 1904	3436	2024-03-26_959bc0b26a5317e31fb1870c14be0323_mafia.exe	95
PID 3436 wrote to memory of 1904	3436	2024-03-26_959bc0b26a5317e31fb1870c14be0323_mafia.exe	95

C:\Users\Admin\AppData\Local\Temp\2024-03-26_959bc0b26a5317e31fb1870c14be0323_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-26_959bc0b26a5317e31fb1870c14be0323_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Users\Admin\AppData\Local\Temp\66C8.tmp
  "C:\Users\Admin\AppData\Local\Temp\66C8.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-03-26_959bc0b26a5317e31fb1870c14be0323_mafia.exe 246A5BBD00DBDB7F8B8021BB731F8D9A58294844A8CF516C31ACEFEB77FB5663377AC0F8D477D6A05EF945E50131AC9A0D53B86560D2BDECA0494ED0FF567E14
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3844 --field-trial-handle=2320,i,3025503729105798828,9325691672526736153,262144 --variations-seed-version /prefetch:8
1⤵
PID:3404

C:\Users\Admin\AppData\Local\Temp\66C8.tmp

Filesize
384KB

MD5
99da594236096c93801285c4b782a53a

SHA1
3b4a795fe7a7fc24562e855162de391eb8b86678

SHA256
6b9afe89b2c9edd7367cd2c685d2d370bfad0df994c1de5cf4770030f59178c9

SHA512
1b60381234879ea531da103f36172e306fd2d79d5ea54acb39ffde65d10014d430c016ee6493bd7272bef290f318d35087e0f281d1e43306d841577b5dc26615

Download Submit