Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
18-07-2024 22:42
Behavioral task
behavioral1
Sample
Maple Raider.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Maple Raider.exe
Resource
win10v2004-20240709-en
General
-
Target
Maple Raider.exe
-
Size
34.1MB
-
MD5
ba1d0780f519ee2807e153d51df5916e
-
SHA1
03f9b5b21a1911ea068e668b041ff827ca0891d7
-
SHA256
aefa057d6fb6507bf21f0243fe2c57a8614fdde589faa78b21929e483ff98a29
-
SHA512
d31b05daeb984427c4b5c476169cdab442723c51324938fc3df700f91ecb35b5b5ba5b1b11297c170fcee0bf2c56d9db7b2ef18b289042eb7a7373745faa9d89
-
SSDEEP
786432:3p039FS+ab44n6ASQSc6k00CZcKoTMS4uEgbFtNFEtKN:3ps9Fnab4+6DQSc6JUCS1NOK
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
Maple Raider.exepid process 2704 Maple Raider.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI21722\python310.dll upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Maple Raider.exedescription pid process target process PID 2172 wrote to memory of 2704 2172 Maple Raider.exe Maple Raider.exe PID 2172 wrote to memory of 2704 2172 Maple Raider.exe Maple Raider.exe PID 2172 wrote to memory of 2704 2172 Maple Raider.exe Maple Raider.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Maple Raider.exe"C:\Users\Admin\AppData\Local\Temp\Maple Raider.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\Maple Raider.exe"C:\Users\Admin\AppData\Local\Temp\Maple Raider.exe"2⤵
- Loads dropped DLL
PID:2704
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD54a6afa2200b1918c413d511c5a3c041c
SHA139ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3
SHA256bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da
SHA512dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20