56aea47f3be4b5db06d1dfcd20b44ac119312aed1151124087aee63fa78a7133

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 20:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mantica.exe
Size

120.5MB
MD5

6a2a25023de3242285ca663442c6f93a
SHA1

8bbe4d462e7f9aac5f61c01404192739f8acb0a6
SHA256

21bcba0401952cf27b324a8449fc75b8222aa8030e5af7441d72ecc26b764c73
SHA512

3eaa468973a36f99b68522096e71d4084d858add60ee4a46a793b5016eadb312b9d2a6bd4f90a7fc2368f12cfb1554d6f9a92aa5c7ec755661d7b4f8bfe8f4e6
SSDEEP

1572864:s1f0+Sva7Hdp1Nhn+aCdrvdYrZ/7/lbg8udR8SnuSE49z:pasulbg8yTnbEOz

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2748	mantica.exe
2748	mantica.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2580	mantica.exe
2748	mantica.exe
2748	mantica.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2688	2748	mantica.exe	28
PID 2748 wrote to memory of 2580	2748	mantica.exe	29
PID 2748 wrote to memory of 2580	2748	mantica.exe	29
PID 2748 wrote to memory of 2580	2748	mantica.exe	29
PID 2748 wrote to memory of 2960	2748	mantica.exe	30
PID 2748 wrote to memory of 2960	2748	mantica.exe	30
PID 2748 wrote to memory of 2960	2748	mantica.exe	30
PID 2748 wrote to memory of 2960	2748	mantica.exe	30
PID 2748 wrote to memory of 2960	2748	mantica.exe	30
PID 2748 wrote to memory of 2960	2748	mantica.exe	30
PID 2748 wrote to memory of 2960	2748	mantica.exe	30
PID 2748 wrote to memory of 2960	2748	mantica.exe	30
PID 2748 wrote to memory of 2960	2748	mantica.exe	30
PID 2748 wrote to memory of 2960	2748	mantica.exe	30
PID 2748 wrote to memory of 2960	2748	mantica.exe	30
PID 2748 wrote to memory of 2960	2748	mantica.exe	30
PID 2748 wrote to memory of 2960	2748	mantica.exe	30
PID 2748 wrote to memory of 2960	2748	mantica.exe	30
PID 2748 wrote to memory of 2960	2748	mantica.exe	30
PID 2748 wrote to memory of 2960	2748	mantica.exe	30
PID 2748 wrote to memory of 2960	2748	mantica.exe	30
PID 2748 wrote to memory of 2960	2748	mantica.exe	30
PID 2748 wrote to memory of 2960	2748	mantica.exe	30
PID 2748 wrote to memory of 2960	2748	mantica.exe	30

C:\Users\Admin\AppData\Local\Temp\mantica.exe
"C:\Users\Admin\AppData\Local\Temp\mantica.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Users\Admin\AppData\Local\Temp\mantica.exe
  "C:\Users\Admin\AppData\Local\Temp\mantica.exe" --type=gpu-process --field-trial-handle=1100,6509472431454035623,6896048404342618920,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1108 /prefetch:2
  2⤵
  PID:2688
- C:\Users\Admin\AppData\Local\Temp\mantica.exe
  "C:\Users\Admin\AppData\Local\Temp\mantica.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1100,6509472431454035623,6896048404342618920,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1468 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2580
- C:\Users\Admin\AppData\Local\Temp\mantica.exe
  "C:\Users\Admin\AppData\Local\Temp\mantica.exe" --type=gpu-process --field-trial-handle=1100,6509472431454035623,6896048404342618920,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1252 /prefetch:2
  2⤵
  PID:2960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\4551bcca-4f9d-4fd9-82e4-53429f022468.tmp.node

Filesize
1.8MB

MD5
3072b68e3c226aff39e6782d025f25a8

SHA1
cf559196d74fa490ac8ce192db222c9f5c5a006a

SHA256
7fb52b781709b065c240b6b81394be6e72e53fe11d7c8e0f7b49dd417eb78a01

SHA512
61ebc72c20195e99244d95af1ab44fa06201a1aee2b5da04490fdc4312e8324a40b0e15a7b42fab5179753d767c1d08ae1a7a56ac71a6e100e63f83db849ee61

Download Submit
\Users\Admin\AppData\Local\Temp\b8945440-a3b6-4058-aefb-e14a8d55c039.tmp.node

Filesize
137KB

MD5
04bfbfec8db966420fe4c7b85ebb506a

SHA1
939bb742a354a92e1dcd3661a62d69e48030a335

SHA256
da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd

SHA512
4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65

Download Submit
memory/2688-9-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/2688-41-0x00000000772E0000-0x00000000772E1000-memory.dmp

Filesize
4KB

Download