Analysis

  • max time kernel
    145s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/07/2024, 20:13

General

  • Target

    mantica 8.4.4.exe

  • Size

    53.3MB

  • MD5

    1a9b3d964cf0ff58923aa13bde9560e8

  • SHA1

    e52cc7da921418d4d3481cdcb1b3e4b8452d2cb0

  • SHA256

    56aea47f3be4b5db06d1dfcd20b44ac119312aed1151124087aee63fa78a7133

  • SHA512

    64811e46e13c9872c24e3a9dec96952608bd8e7d022a72b614d1b7bd36175193440bda830de4eaabfdca8ac29ec4c1b11fe6c6b009e42fcbe2d02ace576a012a

  • SSDEEP

    1572864:g1rYBmKt3e45LIOoiPdrdBI82eRSJ/7piVQ3L:gZYPt0ORdrdBI82eqzkVQ7

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\mantica 8.4.4.exe
    "C:\Users\Admin\AppData\Local\Temp\mantica 8.4.4.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1460
    • C:\Users\Admin\AppData\Local\Temp\2iex8KmtOLKH1KaYNoaYzCGOwen\mantica.exe
      C:\Users\Admin\AppData\Local\Temp\2iex8KmtOLKH1KaYNoaYzCGOwen\mantica.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1532
      • C:\Users\Admin\AppData\Local\Temp\2iex8KmtOLKH1KaYNoaYzCGOwen\mantica.exe
        "C:\Users\Admin\AppData\Local\Temp\2iex8KmtOLKH1KaYNoaYzCGOwen\mantica.exe" --type=gpu-process --field-trial-handle=1692,17638182638944265263,4332165528436874779,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1700 /prefetch:2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1156
      • C:\Users\Admin\AppData\Local\Temp\2iex8KmtOLKH1KaYNoaYzCGOwen\mantica.exe
        "C:\Users\Admin\AppData\Local\Temp\2iex8KmtOLKH1KaYNoaYzCGOwen\mantica.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1692,17638182638944265263,4332165528436874779,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2020 /prefetch:8
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:4116
      • C:\Users\Admin\AppData\Local\Temp\2iex8KmtOLKH1KaYNoaYzCGOwen\mantica.exe
        "C:\Users\Admin\AppData\Local\Temp\2iex8KmtOLKH1KaYNoaYzCGOwen\mantica.exe" --type=gpu-process --field-trial-handle=1692,17638182638944265263,4332165528436874779,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAIAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:4224
  • C:\Windows\System32\CompPkgSrv.exe
    C:\Windows\System32\CompPkgSrv.exe -Embedding
    1⤵
      PID:116

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\2iex8KmtOLKH1KaYNoaYzCGOwen\D3DCompiler_47.dll

      Filesize

      4.3MB

      MD5

      7641e39b7da4077084d2afe7c31032e0

      SHA1

      2256644f69435ff2fee76deb04d918083960d1eb

      SHA256

      44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47

      SHA512

      8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5

    • C:\Users\Admin\AppData\Local\Temp\2iex8KmtOLKH1KaYNoaYzCGOwen\chrome_100_percent.pak

      Filesize

      121KB

      MD5

      06baf0ad34e0231bd76651203dba8326

      SHA1

      a5f99ecdcc06dec9d7f9ce0a8c66e46969117391

      SHA256

      5ae14147992a92548bcad76867dd88cdfcdb69d951c8720920cce6fb135e3189

      SHA512

      aff6616e56781ebb925a0ca146245ad3b2827250b32261c0c7c0d5b10b20a343a17fc3761c95d93104163e77b2eae3f1f9cbd3cb2b377f49b42bea39bdd09b91

    • C:\Users\Admin\AppData\Local\Temp\2iex8KmtOLKH1KaYNoaYzCGOwen\chrome_200_percent.pak

      Filesize

      181KB

      MD5

      57c27201e7cd33471da7ec205fe9973c

      SHA1

      a8e7bce09c4cbdae2797611b2be8aeb5491036f9

      SHA256

      dd8146b2ee289e4d54a4a0f1fd3b2f61b979c6a2baaba96a406d96c3f4fdb33b

      SHA512

      57258aa169bec66abf0f45a3e026bb68751fb970b74bd0cb465607fa3b2a89967e832d92d8f675f0449bb6662fcb7786d05f0597124cc8e18bb99a47245779b4

    • C:\Users\Admin\AppData\Local\Temp\2iex8KmtOLKH1KaYNoaYzCGOwen\ffmpeg.dll

      Filesize

      2.7MB

      MD5

      eabfc10d56cb44a86493cb2f8ca7aab2

      SHA1

      09d7e87f43527333cd021329d6c2f4e8bd8ddab5

      SHA256

      42a2a996ac433ac33a22776b8418a82753557093d90147b7951138b5c83924b6

      SHA512

      ee31e3539fba9e5969a9f38c428f586de2dd7630cb5d8c5e3c2c934b5881f8176b8ab6ef6397c1ce4fa6ccf3ee9615225c7afa0e0b28c6fc23974e8b96625dec

    • C:\Users\Admin\AppData\Local\Temp\2iex8KmtOLKH1KaYNoaYzCGOwen\icudtl.dat

      Filesize

      10.0MB

      MD5

      ad2988770b8cb3281a28783ad833a201

      SHA1

      94b7586ee187d9b58405485f4c551b55615f11b5

      SHA256

      df876c7af43ed93eec6aea4d2d55c805009c219653cdeb368f1d048f4922b108

      SHA512

      f27e542a9c6c60fa28c5b7cc2818079341ef93aef3bbcadecad2dc11aff5b1592b19c7ebfa543ea42a3cbfec26a668641b255545fb0912056e25e852c2dedd01

    • C:\Users\Admin\AppData\Local\Temp\2iex8KmtOLKH1KaYNoaYzCGOwen\libegl.dll

      Filesize

      438KB

      MD5

      660a9ae1282e6205fc0a51e64470eb5b

      SHA1

      f91a9c9559f51a8f33a552f0145ed9e706909de8

      SHA256

      f2a841b6ef320f226965c7cb01fbc4709fc31425e490a3edfa20147ce3656c85

      SHA512

      20bed2bed042033e3d8b077f9d66bce67922aaec180cc3777f20560219226b7efc73932bb87445afda4e3877472ddcd307215d23954cd082051437e5f2224263

    • C:\Users\Admin\AppData\Local\Temp\2iex8KmtOLKH1KaYNoaYzCGOwen\libglesv2.dll

      Filesize

      7.3MB

      MD5

      bc45db0195aa369cc3c572e4e9eefc7e

      SHA1

      b880ca4933656be52f027028af5ef8a3b7e07e97

      SHA256

      a81729fd6ee2d64dfc47501a1d53794cdeee5c1daa3751f7554aea2503686d10

      SHA512

      dd8c39947e7d767fbdccf90c5b3eaedf3937b43c55200d2199107333b63ac09e5356c286618874fac841e1357dd927e0c70b5066c1feeedd8cc6c0fba605ee5f

    • C:\Users\Admin\AppData\Local\Temp\2iex8KmtOLKH1KaYNoaYzCGOwen\locales\en-US.pak

      Filesize

      83KB

      MD5

      bd8f7b719110342b7cefb16ddd05ec55

      SHA1

      82a79aeaa1dd4b1464b67053ba1766a4498c13e7

      SHA256

      d1d3f892be16329c79f9a8ee8c5fa1c9fb46d17edfeb56a3d9407f9d7587a0de

      SHA512

      7cd1493e59e87c70927e66769eb200f79a57e1eb1223af4eb4064088571893d3e32cbc4b5ece568fd308992aad65684aa280dc9834f2b5d327bdee514b046e5e

    • C:\Users\Admin\AppData\Local\Temp\2iex8KmtOLKH1KaYNoaYzCGOwen\resources.pak

      Filesize

      4.8MB

      MD5

      d13873f6fb051266deb3599b14535806

      SHA1

      143782c0ce5a5773ae0aae7a22377c8a6d18a5b2

      SHA256

      7b953443e3cd54a0a4775528b52fbfe5ebecbc2c71731600ed0999d227969506

      SHA512

      1ab38fcb70d1958c74da2493459532b52a04b884009509a1ac8dd39f6e9e670658a52f4d19ef57f1bc71dccfdd6ceedbc18034bbcad0b500d75a97c74aac6939

    • C:\Users\Admin\AppData\Local\Temp\2iex8KmtOLKH1KaYNoaYzCGOwen\resources\app.asar

      Filesize

      11.0MB

      MD5

      07decfd19c1e3c20d987a4e2168171cf

      SHA1

      17202440bf81208e75f456a85727717ffaa25dee

      SHA256

      bc45eb66416f95e7bd8e9db1e4046949c1ff78f264ab6d808b38a861c5930456

      SHA512

      7541c521b23562443120fd5a721c4633bf3cae2cd43f9c6e3aa8ad077ce6b80f510f8f93f65ca5dab6ee6248fe7ccd6c328f1557ace007ef0e2adbbff378fa70

    • C:\Users\Admin\AppData\Local\Temp\2iex8KmtOLKH1KaYNoaYzCGOwen\v8_context_snapshot.bin

      Filesize

      168KB

      MD5

      c2208c06c8ff81bca3c092cc42b8df1b

      SHA1

      f7b9faa9ba0e72d062f68642a02cc8f3fed49910

      SHA256

      4a67de195878d290f49b503b83e415917b8bbcbd9936b07a5d33b48e9bc6e0a3

      SHA512

      6c3c370dd086a976c44d4059a315bd3bcbb50961aa34734e65a40d861cffca9090d47cec74575afe23952e394e4845bda2d8798eebe01fb54a7a6288bce238f5

    • C:\Users\Admin\AppData\Local\Temp\3385b931-9229-44f2-bf4e-d2794131ad5f.tmp.node

      Filesize

      137KB

      MD5

      04bfbfec8db966420fe4c7b85ebb506a

      SHA1

      939bb742a354a92e1dcd3661a62d69e48030a335

      SHA256

      da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd

      SHA512

      4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65

    • C:\Users\Admin\AppData\Local\Temp\99ed2d63-f342-42ed-8915-013d5e445bc0.tmp.node

      Filesize

      1.8MB

      MD5

      3072b68e3c226aff39e6782d025f25a8

      SHA1

      cf559196d74fa490ac8ce192db222c9f5c5a006a

      SHA256

      7fb52b781709b065c240b6b81394be6e72e53fe11d7c8e0f7b49dd417eb78a01

      SHA512

      61ebc72c20195e99244d95af1ab44fa06201a1aee2b5da04490fdc4312e8324a40b0e15a7b42fab5179753d767c1d08ae1a7a56ac71a6e100e63f83db849ee61

    • C:\Users\Admin\AppData\Local\Temp\nsp5322.tmp\StdUtils.dll

      Filesize

      101KB

      MD5

      33b4e69e7835e18b9437623367dd1787

      SHA1

      53afa03edaf931abdc2d828e5a2c89ad573d926c

      SHA256

      72d38ef115e71fc73dc5978987c583fc8c6b50ff12e4a5d30649a4d164a8b6ae

      SHA512

      ca890e785d1a0a7e0b4a748416fba417826ae66b46e600f407d4e795b444612a8b830f579f2cf5b6e051bea800604f34f8801cc3daf05c8d29ad05bcda454a77

    • C:\Users\Admin\AppData\Local\Temp\nsp5322.tmp\System.dll

      Filesize

      11KB

      MD5

      75ed96254fbf894e42058062b4b4f0d1

      SHA1

      996503f1383b49021eb3427bc28d13b5bbd11977

      SHA256

      a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

      SHA512

      58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

    • C:\Users\Admin\AppData\Local\Temp\nsp5322.tmp\nsis7z.dll

      Filesize

      391KB

      MD5

      c6a070b3e68b292bb0efc9b26e85e9cc

      SHA1

      5a922b96eda6595a68fd0a9051236162ff2e2ada

      SHA256

      66ac8bd1f273a73e17a3f31d6add739d3cb0330a6417faeda11a9cae00b62d8b

      SHA512

      8eff8fc16f5bb574bd9483e3b217b67a8986e31497368c06fdaa3a1e93a40aee94a5b31729d01905157b0ae1e556a402f43cd29a4d30a0587e1ec334458a44e8

    • memory/1156-183-0x00007FFEE96F0000-0x00007FFEE96F1000-memory.dmp

      Filesize

      4KB