e537df6303507fd1d6fc67b0e7768e6f61f4d7f5a52442376c019751fc7e6640

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 01:49

Target

2024-04-18_d0bad6e2823fb9cc35c4b199ee2ad716_mafia.exe
Size

412KB
MD5

d0bad6e2823fb9cc35c4b199ee2ad716
SHA1

6f3c47a02c3260b542c48288152e6819793b95cc
SHA256

e537df6303507fd1d6fc67b0e7768e6f61f4d7f5a52442376c019751fc7e6640
SHA512

15ac3af1b4d0a2c891545e84b9019f64f5114bb7b94798157c41476afab95e6bcdd96d4dce7686d4a3a85589f1f09bbd76bc8c8b8f92c8002e9f1108d22e2cec
SSDEEP

6144:UooTAQjKG3wDGAeIc9kphIoDZnVQ0EEXN/2lMKW/bwWtO6txzTwauoTX4xDeP:U6PCrIc9kph5HQ0EEKobwWBtxnKK

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1700	FA1F.tmp

Executes dropped EXE 1 IoCs

pid	Process
1700	FA1F.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 1700	4752	2024-04-18_d0bad6e2823fb9cc35c4b199ee2ad716_mafia.exe	92
PID 4752 wrote to memory of 1700	4752	2024-04-18_d0bad6e2823fb9cc35c4b199ee2ad716_mafia.exe	92
PID 4752 wrote to memory of 1700	4752	2024-04-18_d0bad6e2823fb9cc35c4b199ee2ad716_mafia.exe	92

C:\Users\Admin\AppData\Local\Temp\2024-04-18_d0bad6e2823fb9cc35c4b199ee2ad716_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-18_d0bad6e2823fb9cc35c4b199ee2ad716_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Users\Admin\AppData\Local\Temp\FA1F.tmp
  "C:\Users\Admin\AppData\Local\Temp\FA1F.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-04-18_d0bad6e2823fb9cc35c4b199ee2ad716_mafia.exe 518A658A35B9CA38AD6D25247EFFE629669B6515A278CB7C06C05B421682967555E777B1076EF0853B6C4E4FE521A433A51308301E06CBDCF09875A70686022C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:1372

C:\Users\Admin\AppData\Local\Temp\FA1F.tmp

Filesize
412KB

MD5
fc4325609c21a8e60cfde4ef7a8b7f5b

SHA1
d756a9873f15b996a2479b955f4f0fa07dac0e14

SHA256
2c5eab533221393b28d8c9583c37ea5c0aeb47b9b581fcb3ddcbfc6576a66e80

SHA512
7e718232a61432cd71a011fbcd26fcd5a03cf82c74d1999c35c86192736f4b71538e24510f93b18680551ddbe30934f661a27e9cd48b325ca349b67e4f9eecfe

Download Submit