1800a3ee2afbd290466f448e6d07fbf18510f701997c04993f60a838af7e0937

Analysis

max time kernel
115s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-04-2024 03:54

Target

2024-04-05_893fdb5d495951adc8dda5e2bf357a9b_mafia.exe
Size

411KB
MD5

893fdb5d495951adc8dda5e2bf357a9b
SHA1

d9e6aa9c55e11668a5a61c90d3ff6aaeaf1dd04d
SHA256

1800a3ee2afbd290466f448e6d07fbf18510f701997c04993f60a838af7e0937
SHA512

84d3ee1c15d5c6a5400066d07c1f99f42728a7274ccf40ecade6e20df926b684063dfa0a41ca2ada292844f336c9c156d9ff175aebaf7fe8ea1c4d0e884eca88
SSDEEP

6144:gVdvczEb7GUOpYWhNVynE/mFGIaLGjW00Ah828Li0757UcD0hORjPqHI:gZLolhNVyEvI7WV28Xi47pD0eqHI

Score

7^/10

Deletes itself 1 IoCs

pid	Process
476	6179.tmp

Executes dropped EXE 1 IoCs

pid	Process
476	6179.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 476	1496	2024-04-05_893fdb5d495951adc8dda5e2bf357a9b_mafia.exe	93
PID 1496 wrote to memory of 476	1496	2024-04-05_893fdb5d495951adc8dda5e2bf357a9b_mafia.exe	93
PID 1496 wrote to memory of 476	1496	2024-04-05_893fdb5d495951adc8dda5e2bf357a9b_mafia.exe	93

C:\Users\Admin\AppData\Local\Temp\2024-04-05_893fdb5d495951adc8dda5e2bf357a9b_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-05_893fdb5d495951adc8dda5e2bf357a9b_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Users\Admin\AppData\Local\Temp\6179.tmp
  "C:\Users\Admin\AppData\Local\Temp\6179.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-04-05_893fdb5d495951adc8dda5e2bf357a9b_mafia.exe 941B33E6F915978ABEFDD1E2E9CEBA3F719E22773C8FBB02CDE3E29BCEC3BB0D7B123706DDF568738342E319A8AFA39AC35CAE571DE2D2B62800902475AA7F66
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4172 --field-trial-handle=2280,i,8281149332300504990,9122875031903898779,262144 --variations-seed-version /prefetch:8
1⤵
PID:3080

C:\Users\Admin\AppData\Local\Temp\6179.tmp

Filesize
411KB

MD5
e6941a9bb4d2052c1047b775b656f9b4

SHA1
443867bce9d07a2983fb9e17f9d6ceb23ddf2ee8

SHA256
9e6cf77bcbbb07969d72160578da80969e872b3ea99bc51dd6c9be566fffb759

SHA512
3c02a485580beb7420725c31a4b9d8f68ec025ea407fd5298dd96b0a339f3dc6c4910ff78a046d51682c5c2b2a26d20c96a3179668fbc34ef7fa8c7d7870e0f2

Download Submit