Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
-
submitted
04/04/2024, 16:30
General
-
Target
2024-04-04_18fded5689537a01dc59cf684ce54635_mafia.exe
-
Size
384KB
-
MD5
18fded5689537a01dc59cf684ce54635
-
SHA1
e646730e568c881d0c6619768121021c77b0333c
-
SHA256
19c4b1095604b02364ecab4f41e32d00dd725c9515a9f5f863b44d8ba8b598f0
-
SHA512
b8467436e739427c3b80a5f7ff8f9dc89ec54d1d3d090a30a674c37a54d733c8f90f3bd588bb99444c489b7db93dc25871d24ffbcbf38a00d690fa94f5f9ae63
-
SSDEEP
6144:drxfv4co9ZL3GBGgjODxbf7hH2w1gvAmSgSZA5gu0lmJ7LNtclBF8QByeZ:Zm48gODxbzUw1gD0urtwBF8QTZ
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-04_18fded5689537a01dc59cf684ce54635_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-04_18fded5689537a01dc59cf684ce54635_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-04-04_18fded5689537a01dc59cf684ce54635_mafia.exe 691B7F91E797EE7C1EE06EAFB4E5B9F952EB3D7F82E378124DA0CCD94EEC976A81FB3508301BAE0C27C1E347E2E3C5530D46F5DCFDB2711C31A8BE72BD4620272⤵
- Deletes itself
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
384KB
MD5aa2f290eb1bca723be7ea7bb5beec742
SHA199359fef26052a15304c7011e1c7f96a5541b5f5
SHA2560d32b8507fd2b3666d85a2225c1b2f407d94e29dcd1e475ac81baee044e0c7d7
SHA512c3349721228e6ddde306f1a83402ef30e60594c51cfd890d4da778997eedeae2856e21136e2e49fd0ae880d87b80f51fd1a05ad60faec9b7aa47e6da2b7fd446