Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    28/04/2024, 00:36

General

  • Target

    2024-04-28_b565cf3e49551f8d25b9a3553956034b_mafia.exe

  • Size

    468KB

  • MD5

    b565cf3e49551f8d25b9a3553956034b

  • SHA1

    1b732e3f3684fa822bf1d1a77781e4adb539b4c8

  • SHA256

    0e193621d01a55a6f23d3c89174b3ef1c40618906183abab0a32718f7635f28c

  • SHA512

    ce4e5f54a7279e35f1aa1cebd6c6e677d3193c9f6ed2070383e457c87016164e6ad4bb6127d6b709dc025315156def95df7c9178610598c7d2ac3ec07929f803

  • SSDEEP

    12288:qO4rfItL8HGs4a6qe44ms8+ixKBY8i7bWmeEVGL:qO4rQtGGs6qe44mspiYW/umeEVGL

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-28_b565cf3e49551f8d25b9a3553956034b_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-28_b565cf3e49551f8d25b9a3553956034b_mafia.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Users\Admin\AppData\Local\Temp\1786.tmp
      "C:\Users\Admin\AppData\Local\Temp\1786.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-28_b565cf3e49551f8d25b9a3553956034b_mafia.exe 02249040237DF7DB065C9CA8F0391141F8A680633888884B401D6B977ECEF1ABD8BF9C90EA67E7531499C8D48A4BCD77C1B82901D550B840963702A0405D3BD8
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:2512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\1786.tmp

    Filesize

    468KB

    MD5

    2440abc1a608b8e89abbc29310b093da

    SHA1

    69a31791910d8045ca2aaeadb47366bd2bf91d71

    SHA256

    b62e685015f163f1240452049b6f71337aa6afae11cad3baa2192d6548a23b20

    SHA512

    32f8fd883ede40519a6c741cb23d0d62c4d964b3286059c456465ff1a37c491440b697dab494c9361b2f1676f2c41c0f9e6b7354ab4e79aea6de3e32865a86cb