Analysis

  • max time kernel
    102s
  • max time network
    213s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20250410-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250410-enlocale:en-usos:windows10-ltsc_2021-x64system
  • submitted
    14/04/2025, 23:25

General

  • Target

    dist/mapper/map.exe

  • Size

    5.2MB

  • MD5

    4b7ac12256a768c1f344de2f169f5728

  • SHA1

    40d63f9cf769b2304420737132cbd6a63a44eb96

  • SHA256

    0910c0d226f1f5cb9a6ffaabb70e08b194bbf0b21617beb88109c2cf10987c4e

  • SHA512

    e2f50413ba791b0cf6d92922b8f9db59e686837e8d2f9e1a097f0ad72cf59a66a8bbd2c0d5567e059ef2b05dc28aa443ad9409aced4475d55324096abe9abfaf

  • SSDEEP

    98304:4uUx/rgmBLSmmoVIuKZxi8MHs6W2ZVci5lQ9pOidDXCc41t7uGkNP:pUx/rdSmmylyxz6zVc03gDyc4gN

Score
7/10

Malware Config

Signatures

  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dist\mapper\map.exe
    "C:\Users\Admin\AppData\Local\Temp\dist\mapper\map.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:4868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4868-0-0x00007FF735924000-0x00007FF735C7F000-memory.dmp

    Filesize

    3.4MB

  • memory/4868-1-0x00007FFF76990000-0x00007FFF76992000-memory.dmp

    Filesize

    8KB

  • memory/4868-4-0x00007FF735900000-0x00007FF7361B7000-memory.dmp

    Filesize

    8.7MB

  • memory/4868-6-0x00007FF735924000-0x00007FF735C7F000-memory.dmp

    Filesize

    3.4MB

  • memory/4868-7-0x00007FF735900000-0x00007FF7361B7000-memory.dmp

    Filesize

    8.7MB