Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
04-08-2024 10:58
Behavioral task
behavioral1
Sample
Maple Raider.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Maple Raider.exe
Resource
win10v2004-20240802-en
gurcumilleniumratcollectioncredential_accessdefense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationpyinstallerratspywarestealerupx
windows10-2004-x64
52 signatures
150 seconds
General
-
Target
Maple Raider.exe
-
Size
34.1MB
-
MD5
ba1d0780f519ee2807e153d51df5916e
-
SHA1
03f9b5b21a1911ea068e668b041ff827ca0891d7
-
SHA256
aefa057d6fb6507bf21f0243fe2c57a8614fdde589faa78b21929e483ff98a29
-
SHA512
d31b05daeb984427c4b5c476169cdab442723c51324938fc3df700f91ecb35b5b5ba5b1b11297c170fcee0bf2c56d9db7b2ef18b289042eb7a7373745faa9d89
-
SSDEEP
786432:3p039FS+ab44n6ASQSc6k00CZcKoTMS4uEgbFtNFEtKN:3ps9Fnab4+6DQSc6JUCS1NOK
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2332 Maple Raider.exe -
resource yara_rule behavioral1/files/0x0005000000019524-12.dat upx behavioral1/memory/2332-14-0x000007FEF68E0000-0x000007FEF6D46000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2916 taskmgr.exe 604 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2916 taskmgr.exe Token: SeDebugPrivilege 604 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 2916 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe 604 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 772 wrote to memory of 2332 772 Maple Raider.exe 30 PID 772 wrote to memory of 2332 772 Maple Raider.exe 30 PID 772 wrote to memory of 2332 772 Maple Raider.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Maple Raider.exe"C:\Users\Admin\AppData\Local\Temp\Maple Raider.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\Maple Raider.exe"C:\Users\Admin\AppData\Local\Temp\Maple Raider.exe"2⤵
- Loads dropped DLL
PID:2332
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2916
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2796
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:604
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1676
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD54a6afa2200b1918c413d511c5a3c041c
SHA139ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3
SHA256bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da
SHA512dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20