Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/04/2024, 21:25
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-19_267bbae1c7d210dee1965dc1afdfe40b_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-19_267bbae1c7d210dee1965dc1afdfe40b_mafia.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-19_267bbae1c7d210dee1965dc1afdfe40b_mafia.exe
-
Size
479KB
-
MD5
267bbae1c7d210dee1965dc1afdfe40b
-
SHA1
7207a52bc51b95cb42e350424fadfd4ce7ec32d9
-
SHA256
f3630a52d2a07c8ba51b14b1b079e53c3a2cdef1f405acf7af0c4776e01ceef2
-
SHA512
c281b39d8c1b07d69e3d11ae4c67949ba82b252bc6913038135967c2f257b546a3531862f4d7bd289129b87c3e1b9f5c82a2467de09804e1b12caad8fcbb8902
-
SSDEEP
12288:bO4rfItL8HAzjXuRpIEQCk5UEw0Lcqm8p75UO:bO4rQtGA3XuRpth2w0gqppVUO
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2588 13EE.tmp -
Executes dropped EXE 1 IoCs
pid Process 2588 13EE.tmp -
Loads dropped DLL 1 IoCs
pid Process 1712 2024-04-19_267bbae1c7d210dee1965dc1afdfe40b_mafia.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1712 wrote to memory of 2588 1712 2024-04-19_267bbae1c7d210dee1965dc1afdfe40b_mafia.exe 28 PID 1712 wrote to memory of 2588 1712 2024-04-19_267bbae1c7d210dee1965dc1afdfe40b_mafia.exe 28 PID 1712 wrote to memory of 2588 1712 2024-04-19_267bbae1c7d210dee1965dc1afdfe40b_mafia.exe 28 PID 1712 wrote to memory of 2588 1712 2024-04-19_267bbae1c7d210dee1965dc1afdfe40b_mafia.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-19_267bbae1c7d210dee1965dc1afdfe40b_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-19_267bbae1c7d210dee1965dc1afdfe40b_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\13EE.tmp"C:\Users\Admin\AppData\Local\Temp\13EE.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-19_267bbae1c7d210dee1965dc1afdfe40b_mafia.exe D8C1920C1E13D139A3BB61677396693BC78909074265160F953EEAE8D16C7C582F7803EDEA2E76090A5BDB3E9577FE471A84DBD9A4EABACEEBC8B5701E54DA812⤵
- Deletes itself
- Executes dropped EXE
PID:2588
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
479KB
MD571bdf38ba4fae574b1c7196e433328e5
SHA1a2fad5f2191ec734f0822dda015c71f2ae8a2233
SHA256b24f223438e39d351eaefc3ea30ba4a7e466124b92e31cb105af0d300d8b9247
SHA5123fb79bb2c05beadef372642abbb4110ff9c5af5bd01305c65b9551a7cbcd9e0f47d78ec406896f6a476cf114da6475ded78222d48212870bbf012659175ffd71