Analysis
-
max time kernel
138s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
24/06/2024, 09:08
General
-
Target
2024-06-24_cde629b0cb2a11d8f6d9d3b6029e4ba9_mafia.exe
-
Size
4.3MB
-
MD5
cde629b0cb2a11d8f6d9d3b6029e4ba9
-
SHA1
03bfb1e05531c5a8a27553bc00cbe7ee51e46e3e
-
SHA256
b3acfcd098191efd748a698fee9629b0e7bd745db99a232262b1f3403e4c0764
-
SHA512
facdb9c45c55667261c5e0158261ef655384dde6bcb936316b9028c491d81d6b9b0ef22eda13c139937e49dc3e49b1c1b8879e795339df71578b27f210326968
-
SSDEEP
49152:RKyf6l5QZuTtS0rQMYOQ+q8CE8SW5wpIXG1Zz9KFeMdOQ+q8r:RglWsM0r1QnLS0G1R0FehQS
Score
9/10
Malware Config
Signatures
-
Detects executables packed with VMProtect. 3 IoCs
-
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_cde629b0cb2a11d8f6d9d3b6029e4ba9_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-24_cde629b0cb2a11d8f6d9d3b6029e4ba9_mafia.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
972KB
-
Filesize
972KB
-
Filesize
972KB