d9ec823fcf59b7aeb8f178f34ed225ea756a0a7771e545721e5dbd95ef3b241d

Analysis

max time kernel
115s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 14:26

Target

2024-03-28_19be3103558166db1bd2b25729fa1fc2_mafia.exe
Size

435KB
MD5

19be3103558166db1bd2b25729fa1fc2
SHA1

ecd73c2a55139c86cbd7a1cfc6229895764c4e67
SHA256

d9ec823fcf59b7aeb8f178f34ed225ea756a0a7771e545721e5dbd95ef3b241d
SHA512

ad20f9c4c7e20c8fc67ea8c22005d37dab54cae69df555dc9904d5c1c56fc473e59299e28d546ede422d7c1615cac17b5d33c3b5d5291ce6af21c2c39f5edb07
SSDEEP

6144:98Xyq4o4aRCTuuqepiq+zQ1mBYy1898jJqXJcIjwmL4k5tzRyh/M1UQJK:9W4ufepiqKQ1mF+9OicIjwE5byhuVJ

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4652	6AC0.tmp

Executes dropped EXE 1 IoCs

pid	Process
4652	6AC0.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 4652	552	2024-03-28_19be3103558166db1bd2b25729fa1fc2_mafia.exe	93
PID 552 wrote to memory of 4652	552	2024-03-28_19be3103558166db1bd2b25729fa1fc2_mafia.exe	93
PID 552 wrote to memory of 4652	552	2024-03-28_19be3103558166db1bd2b25729fa1fc2_mafia.exe	93

C:\Users\Admin\AppData\Local\Temp\2024-03-28_19be3103558166db1bd2b25729fa1fc2_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-28_19be3103558166db1bd2b25729fa1fc2_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:552
- C:\Users\Admin\AppData\Local\Temp\6AC0.tmp
  "C:\Users\Admin\AppData\Local\Temp\6AC0.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-28_19be3103558166db1bd2b25729fa1fc2_mafia.exe 03CEC3E16C5446B75FCFF10D7BE539CFE6CDBD8B1F3EA92B64A26426C6D4DF80B9EC635B5DE6A8D9C7AE473D80280657E0DD7BC5EEECA0944433EFB7B729C06E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3472 --field-trial-handle=2260,i,3303482231723870786,2954015409682154873,262144 --variations-seed-version /prefetch:8
1⤵
PID:1324

C:\Users\Admin\AppData\Local\Temp\6AC0.tmp

Filesize
435KB

MD5
370df2153836c345b06e81925c2fb668

SHA1
d8ec6b0117125f29a31929d1dacd1d09d78fddb7

SHA256
1b773f13e485bba18b190db1334ee3333e50dfddd07a4b6173be559da9c6e7f4

SHA512
dc1905694c5dbc57e5abffa024a6b7e0438e725d651892e138015f70c53f42950134858e4f26a0412256ecd8446b9e8d221bc5152ad6c941e0db44f67c67bf6f

Download Submit