Analysis
-
max time kernel
91s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
03-07-2024 07:24
General
-
Target
2024-07-03_3055d7d856193351022b17de82794048_mafia.exe
-
Size
1.0MB
-
MD5
3055d7d856193351022b17de82794048
-
SHA1
87a0ea8df4c9ee9c8f94765dec476bb050bd6fca
-
SHA256
9dbdfb34255ed018dd25d41538988d063ec2bbb427e4119fa65d13067cfb2931
-
SHA512
3086b3f56c33d5f190918a3bb00e3a9a5d2211ebe76dd454024ad4147db243f3f2862bd369e355d40d82598ce5d0fddb3dd1be5feed0d818e980eeff070ee680
-
SSDEEP
24576:sXpcw+dqjKPadLWGxkMOHbeMIeGqZsEr6:sXwYKPadLWGxkMOHu0Si6
Score
10/10
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Drops file in System32 directory 8 IoCs
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-03_3055d7d856193351022b17de82794048_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-03_3055d7d856193351022b17de82794048_mafia.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses