Overview

overview

8

Static

static

3

mapperv2.exe

windows7-x64

8

mapperv2.exe

windows10-2004-x64

5

Analysis

  • max time kernel
    142s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/06/2024, 04:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    mapperv2.exe

  • Size

    3.4MB

  • MD5

    1313bee2dddfe4a7a41627b88bde56cd

  • SHA1

    df5a51a6ec8fdebbca2b4638f14df855d6d29d8d

  • SHA256

    8ada5119dab4f9b69772d769f0704addcccda9f192b52d58f6b5739b1fb3ceed

  • SHA512

    c9fbfa2ba20158512c35d44b10a91f9a33fa88654f24c0a8d3428eae30d9a5ddef4c306b4a41e35135173e5a4bb16d2467e00fb51e22cc2e8e92e8fc9325e9a5

  • SSDEEP

    49152:TZ6KpPT03aUq1f/m0XE42tw4+bGFoJ/8D1XGpV8C4cDF/jQouhdGXLTPPa9zFck/:E3/W/m/dWl8hmQyjeLG7TK9zFcBtG

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\mapperv2.exe
    "C:\Users\Admin\AppData\Local\Temp\mapperv2.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4848
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\mapperv2.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1432
      • C:\Windows\system32\certutil.exe
        certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\mapperv2.exe" MD5
        3⤵
          PID:440
        • C:\Windows\system32\find.exe
          find /i /v "md5"
          3⤵
            PID:3736
          • C:\Windows\system32\find.exe
            find /i /v "certutil"
            3⤵
              PID:1920
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\key.dat" MD5 | find /i /v "md5" | find /i /v "certutil"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:488
            • C:\Windows\system32\certutil.exe
              certutil -hashfile "C:\key.dat" MD5
              3⤵
                PID:4740
              • C:\Windows\system32\find.exe
                find /i /v "md5"
                3⤵
                  PID:2352
                • C:\Windows\system32\find.exe
                  find /i /v "certutil"
                  3⤵
                    PID:1104
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1316 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
                1⤵
                  PID:3208

                Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • memory/4848-0-0x00007FF638E91000-0x00007FF6390EC000-memory.dmp

                  Filesize

                  2.4MB

                  Download

                • memory/4848-7-0x00007FF638DF0000-0x00007FF639454000-memory.dmp

                  Filesize

                  6.4MB

                  Download

                • memory/4848-3-0x00007FF638DF0000-0x00007FF639454000-memory.dmp

                  Filesize

                  6.4MB

                  Download

                • memory/4848-8-0x00007FF638DF0000-0x00007FF639454000-memory.dmp

                  Filesize

                  6.4MB

                  Download

                • memory/4848-2-0x00007FFE8D6E0000-0x00007FFE8D6E2000-memory.dmp

                  Filesize

                  8KB

                  Download

                • memory/4848-1-0x00007FFE8D6D0000-0x00007FFE8D6D2000-memory.dmp

                  Filesize

                  8KB

                  Download

                • memory/4848-9-0x00007FF638E91000-0x00007FF6390EC000-memory.dmp

                  Filesize

                  2.4MB

                  Download

                • memory/4848-10-0x00007FF638DF0000-0x00007FF639454000-memory.dmp

                  Filesize

                  6.4MB

                  Download