Overview

overview

10

Static

static

3

Maple Raider.exe

windows7-x64

7

Maple Raider.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    04-08-2024 10:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Maple Raider.exe

  • Size

    34.1MB

  • MD5

    ba1d0780f519ee2807e153d51df5916e

  • SHA1

    03f9b5b21a1911ea068e668b041ff827ca0891d7

  • SHA256

    aefa057d6fb6507bf21f0243fe2c57a8614fdde589faa78b21929e483ff98a29

  • SHA512

    d31b05daeb984427c4b5c476169cdab442723c51324938fc3df700f91ecb35b5b5ba5b1b11297c170fcee0bf2c56d9db7b2ef18b289042eb7a7373745faa9d89

  • SSDEEP

    786432:3p039FS+ab44n6ASQSc6k00CZcKoTMS4uEgbFtNFEtKN:3ps9Fnab4+6DQSc6JUCS1NOK

Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Maple Raider.exe
    "C:\Users\Admin\AppData\Local\Temp\Maple Raider.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:772
    • C:\Users\Admin\AppData\Local\Temp\Maple Raider.exe
      "C:\Users\Admin\AppData\Local\Temp\Maple Raider.exe"
      2⤵
      • Loads dropped DLL
      PID:2332
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2916
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:2796
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:604
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1676

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\_MEI7722\python310.dll
        Filesize

        1.4MB

        MD5

        4a6afa2200b1918c413d511c5a3c041c

        SHA1

        39ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3

        SHA256

        bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da

        SHA512

        dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20

        Download Submit

      • memory/604-28-0x0000000140000000-0x00000001405E8000-memory.dmp

        Filesize

        5.9MB

        Download

      • memory/604-29-0x0000000140000000-0x00000001405E8000-memory.dmp

        Filesize

        5.9MB

        Download

      • memory/604-30-0x0000000140000000-0x00000001405E8000-memory.dmp

        Filesize

        5.9MB

        Download

      • memory/2332-14-0x000007FEF68E0000-0x000007FEF6D46000-memory.dmp

        Filesize

        4.4MB

        Download

      • memory/2916-26-0x0000000140000000-0x00000001405E8000-memory.dmp

        Filesize

        5.9MB

        Download

      • memory/2916-27-0x0000000140000000-0x00000001405E8000-memory.dmp

        Filesize

        5.9MB

        Download