9e94ea1ded5f08e82e0260c43de3d9e59537cecefbb1fd0746afcb890407767f

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 18:42

Target
2024-04-15_08cb8154f9975b09ef5c187b0f457ebc_mafia.exe
Size 428KB
Sample240415-xcbbpaff6z
SHA256 9e94ea1ded5f08e82e0260c43de3d9e59537cecefbb1fd0746afcb890407767f
MD5 08cb8154f9975b09ef5c187b0f457ebc
SHA1 724e99b9bb207c45ac5f7274ee9f553840370592
SHA512 1fd7794870e93d41310a91eab9eb03d21ed6b73e7c71034b8e6919213fb5a427809532a63fa87069b76d4b5b4bdba02c2236f580be6c9c896e5eeb51a3c15381
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFqOMjNIwTOjtGqXQKZHgo1qHR:gZLolhNVyENStGAQWqHR
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3896	F2AD.tmp

Executes dropped EXE 1 IoCs

pid	Process
3896	F2AD.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 3896	1424	2024-04-15_08cb8154f9975b09ef5c187b0f457ebc_mafia.exe	90
PID 1424 wrote to memory of 3896	1424	2024-04-15_08cb8154f9975b09ef5c187b0f457ebc_mafia.exe	90
PID 1424 wrote to memory of 3896	1424	2024-04-15_08cb8154f9975b09ef5c187b0f457ebc_mafia.exe	90

C:\Users\Admin\AppData\Local\Temp\2024-04-15_08cb8154f9975b09ef5c187b0f457ebc_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-15_08cb8154f9975b09ef5c187b0f457ebc_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Users\Admin\AppData\Local\Temp\F2AD.tmp
  "C:\Users\Admin\AppData\Local\Temp\F2AD.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-04-15_08cb8154f9975b09ef5c187b0f457ebc_mafia.exe F9F92F2D7DDCA342583D496326AFD2953012ACADB4EFFDD74B74CDF12EE03CB118E1E9BE4E64B7FC4160946FA57E589B1FD9F64E0F70FE8A6A8B1BE9CB819EE9
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3020 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:3572

F2AD.tmp

Path C:\Users\Admin\AppData\Local\Temp\F2AD.tmp
Size 428KB
SHA256 65c13b2f8257473e39843c9f04296085268775855a23f185fb9f3a8cd476cd4d
MD5 b28bce51e1d8351ca2bda7e4923f4cbf
SHA1 b22c0c4296e0e041262846ecfacc2a59b55d3e9b
SHA512 3d288fe143d3e68770a0d935e0d2ee5a4a1bf8933f6bc7f71c1e109dca7d522c9fe3b646d23ba17c052194984b1d4802abe5d23dc4ee800365d2c9b0ba39d245
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFRiCJ1CzRv5bfTyb2f48Ge0qHR:gZLolhNVyEA1CFMb2fue0qHR
MD5 SHA1 SHA512 SSDEEP

Submit Download