af8a19443518dd4b892c8080ea61b6d87674c73faf1f8f4061d025eec3999649

Analysis

max time kernel
98s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
03/03/2025, 06:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

New folder/Mantas.exe
Size

40KB
MD5

53f25f98742c5114eec23c6487af624c
SHA1

671af46401450d6ed9c0904402391640a1bddcc2
SHA256

7b5dec6a48ee2114c3056f4ccb6935f3e7418ef0b0bc4a58931f2c80fc94d705
SHA512

f460775308b34552c930c3f256cef1069b28421673d71e3fa2712b0467485861a98285925ae49f1adea1faf59265b964c873c12a3bb5de216122ac20084e1048
SSDEEP

768:rz4RBkfbi/FG9Of8Ejex0a6zALVlXt32KtYFPYA3HxAnIIGSEsu:4Ciw9a8EG05zMt3jKYA3xAYns

Score

6^/10

discovery persistence upx

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Manager = "C:\\Windows\\system32\\winmants.exe"	Mantas.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\winmants.exe	Mantas.exe
File opened for modification	C:\Windows\SysWOW64\winmants.exe	Mantas.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral24/memory/5024-0-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral24/files/0x0007000000023d25-20.dat	upx
behavioral24/memory/5024-699-0x0000000000400000-0x0000000000413000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\gnucleus\downloads\teen .scr	Mantas.exe
File created	C:\Program Files\gnucleus\downloads\password dumper.exe	Mantas.exe
File created	C:\Program Files\grokster\my grokster\WinMX .exe	Mantas.exe
File created	C:\Program Files\KazaaLite\My shared folders\kazaalite.exe	Mantas.exe
File created	C:\Program Files\KazaaLite\My shared folder\PerAntivirus Crack.exe	Mantas.exe
File created	C:\Program Files\KazaaLite\My shared folders\help.exe	Mantas.exe
File created	C:\Program Files\icq\shared files\MSBlaster Patch.exe	Mantas.exe
File created	C:\Program Files\icq\shared files\Emulator.exe	Mantas.exe
File created	C:\Program Files\limewire\shared\epsxe.exe	Mantas.exe
File created	C:\Program Files\morpheus\my shared folder\Goodtool.exe	Mantas.exe
File created	C:\Program Files\grokster\my grokster\Nero Burning ROM.exe	Mantas.exe
File created	C:\Program Files\KazaaLite\My shared folder\Warcraft III NoCD Crack.exe	Mantas.exe
File created	C:\Program Files\KazaaLite\My shared folder\DukeNukem-Install.exe	Mantas.exe
File created	C:\Program Files\KazaaLite\My shared folders\WS_FTP LE (32-bit) .exe	Mantas.exe
File opened for modification	C:\Program Files\icq\shared files\cumshot.jpg	Mantas.exe
File created	C:\Program Files\morpheus\my shared folder\Ad-aware .exe	Mantas.exe
File opened for modification	C:\Program Files\KazaaLite\My shared folders\child porn.jpg	Mantas.exe
File created	C:\Program Files\gnucleus\downloads\Mp3finder.exe	Mantas.exe
File created	C:\Program Files\icq\shared files\FlashFXP Crack.exe	Mantas.exe
File created	C:\Program Files\limewire\shared\crack.exe	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\GTA3 nocd crack.exe	Mantas.exe
File created	C:\Program Files\KazaaLite\My shared folders\mp3.exe	Mantas.exe
File created	C:\Program Files\KazaaLite\My shared folders\Msn Hack.exe	Mantas.exe
File created	C:\Program Files\icq\shared files\gba-renamer.exe	Mantas.exe
File opened for modification	C:\Program Files\limewire\shared\anal sex.jpg	Mantas.exe
File opened for modification	C:\Program Files\morpheus\my shared folder\cum.jpg	Mantas.exe
File created	C:\Program Files\grokster\my grokster\hotfix.exe	Mantas.exe
File created	C:\Program Files\KazaaLite\My shared folders\GCN Emulator.exe	Mantas.exe
File created	C:\Program Files\limewire\shared\DVD2AVI.exe	Mantas.exe
File created	C:\Program Files\morpheus\my shared folder\No CD Crack.exe	Mantas.exe
File created	C:\Program Files\grokster\my grokster\setup.exe	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\rap.exe	Mantas.exe
File created	C:\Program Files\KazaaLite\My shared folders\SnagIt .exe	Mantas.exe
File created	C:\Program Files\gnucleus\downloads\Wolfenstein.exe	Mantas.exe
File created	C:\Program Files\icq\shared files\aimbot.exe	Mantas.exe
File created	C:\Program Files\morpheus\my shared folder\MSBlaster Patch.exe	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\Download Accelerator Plus.exe	Mantas.exe
File created	C:\Program Files\morpheus\my shared folder\mp3.exe	Mantas.exe
File opened for modification	C:\Program Files\grokster\my grokster\sweet.jpg	Mantas.exe
File created	C:\Program Files\KazaaLite\My shared folders\winxp service pack.exe	Mantas.exe
File created	C:\Program Files\edonkey2000\incoming\Winrar.exe	Mantas.exe
File opened for modification	C:\Program Files\limewire\shared\0m1a2n3t4a7s8.jpg	Mantas.exe
File created	C:\Program Files\limewire\shared\Gamecube Emulator.exe	Mantas.exe
File created	C:\Program Files\KazaaLite\My shared folder\DoomII-Install.exe	Mantas.exe
File opened for modification	C:\Program Files\gnucleus\downloads\sweet.jpg	Mantas.exe
File created	C:\Program Files\gnucleus\downloads\rom.exe	Mantas.exe
File created	C:\Program Files\icq\shared files\Winzip.exe	Mantas.exe
File created	C:\Program Files\icq\shared files\rom.exe	Mantas.exe
File created	C:\Program Files\limewire\shared\secret.exe	Mantas.exe
File created	C:\Program Files\edonkey2000\incoming\password dumper.exe	Mantas.exe
File created	C:\Program Files\edonkey2000\incoming\roms	Mantas.exe
File created	C:\Program Files\grokster\my grokster\kazaalite.exe	Mantas.exe
File created	C:\Program Files\grokster\my grokster\Winzip.exe	Mantas.exe
File created	C:\Program Files\Kazaa\My shared folder\WinMX .exe	Mantas.exe
File created	C:\Program Files\KazaaLite\My shared folder\No CD Crack.exe	Mantas.exe
File created	C:\Program Files\KazaaLite\My shared folders\Kazaa 2.05 beta .exe	Mantas.exe
File created	C:\Program Files\edonkey2000\incoming\Registry Mechanic.exe	Mantas.exe
File created	C:\Program Files\gnucleus\downloads\nocd crack.exe	Mantas.exe
File created	C:\Program Files\icq\shared files\Msn Hack.exe	Mantas.exe
File created	C:\Program Files\morpheus\my shared folder\Winamp3-Full.exe	Mantas.exe
File created	C:\Program Files\grokster\my grokster\FruityLoops Setup.exe	Mantas.exe
File created	C:\Program Files\KazaaLite\My shared folders\Winzip.exe	Mantas.exe
File created	C:\Program Files\KazaaLite\My shared folders\Ad-aware .exe	Mantas.exe
File created	C:\Program Files\edonkey2000\incoming\1000 Games.exe	Mantas.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mantas.exe

C:\Users\Admin\AppData\Local\Temp\New folder\Mantas.exe
"C:\Users\Admin\AppData\Local\Temp\New folder\Mantas.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\install.exe

Filesize
40KB

MD5
53f25f98742c5114eec23c6487af624c

SHA1
671af46401450d6ed9c0904402391640a1bddcc2

SHA256
7b5dec6a48ee2114c3056f4ccb6935f3e7418ef0b0bc4a58931f2c80fc94d705

SHA512
f460775308b34552c930c3f256cef1069b28421673d71e3fa2712b0467485861a98285925ae49f1adea1faf59265b964c873c12a3bb5de216122ac20084e1048

Download Submit
C:\Users\Admin\Documents\sweet.jpg

Filesize
23KB

MD5
58b1840b979ae31f23aa8eb3594d5c17

SHA1
6b28b8e047cee70c7fa42715c552ea13a5671bbb

SHA256
b2bb460aa299c6064e7fc947bff314e0f915c6ee6f8f700007129e3b6a314f47

SHA512
13548e5900bddc6797d573fcca24cec1f1eefa0662e9d07c4055a3899460f4e135e1c76197b57a49b452e61e201cb86d1960f3e8b00828a2d0031dc9aa78666a

Download Submit
memory/5024-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/5024-699-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads