Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    19/04/2024, 21:25

General

  • Target

    2024-04-19_267bbae1c7d210dee1965dc1afdfe40b_mafia.exe

  • Size

    479KB

  • MD5

    267bbae1c7d210dee1965dc1afdfe40b

  • SHA1

    7207a52bc51b95cb42e350424fadfd4ce7ec32d9

  • SHA256

    f3630a52d2a07c8ba51b14b1b079e53c3a2cdef1f405acf7af0c4776e01ceef2

  • SHA512

    c281b39d8c1b07d69e3d11ae4c67949ba82b252bc6913038135967c2f257b546a3531862f4d7bd289129b87c3e1b9f5c82a2467de09804e1b12caad8fcbb8902

  • SSDEEP

    12288:bO4rfItL8HAzjXuRpIEQCk5UEw0Lcqm8p75UO:bO4rQtGA3XuRpth2w0gqppVUO

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-19_267bbae1c7d210dee1965dc1afdfe40b_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-19_267bbae1c7d210dee1965dc1afdfe40b_mafia.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Users\Admin\AppData\Local\Temp\13EE.tmp
      "C:\Users\Admin\AppData\Local\Temp\13EE.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-19_267bbae1c7d210dee1965dc1afdfe40b_mafia.exe D8C1920C1E13D139A3BB61677396693BC78909074265160F953EEAE8D16C7C582F7803EDEA2E76090A5BDB3E9577FE471A84DBD9A4EABACEEBC8B5701E54DA81
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:2588

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\13EE.tmp

          Filesize

          479KB

          MD5

          71bdf38ba4fae574b1c7196e433328e5

          SHA1

          a2fad5f2191ec734f0822dda015c71f2ae8a2233

          SHA256

          b24f223438e39d351eaefc3ea30ba4a7e466124b92e31cb105af0d300d8b9247

          SHA512

          3fb79bb2c05beadef372642abbb4110ff9c5af5bd01305c65b9551a7cbcd9e0f47d78ec406896f6a476cf114da6475ded78222d48212870bbf012659175ffd71