ee521c972d5c91223efeecd4b04bbfff52832d0cee9d6c430e7a190d6af27bc7

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
898s
max time network
490s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
19/06/2026, 22:42

Target
Release/Mapper.exe
Size 1.3MB
Sample260619-2m69bsc141
SHA256 ee521c972d5c91223efeecd4b04bbfff52832d0cee9d6c430e7a190d6af27bc7
MD5 a3aae65d075c2185d5e7c98b9b6ccb7e
SHA1 560f1e00deced0b05477c1362b9e1c5eedd00579
SHA512 51bdb4df7fd550f9c393df332092651ff2d7feba7c6cc68b1484320efb2f71fa05394a25eb0e31c699f69561e9de3469af852015eb9d659c7ccea9cb2c489e6b
SSDEEP 24576:YxczAUqCsmeKGIC0wmCCvBdkzIWxaiNJsDGqotqVQ3tKCxfhBIscRHSqzMVLksBa:tXCCo
TLSH
T179558CED526E147DE224C631D985650BBBF1FD8E2B51DFBA2BA14CC1683F840B631A70
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\CoreDeviceDriver.sys	Mapper.exe
File created	C:\Windows\System32\drivers\SmartConnectDriver.sys	Mapper.exe
File opened for modification	C:\Windows\System32\drivers\CoreDeviceDriver.sys	Mapper.exe
File opened for modification	C:\Windows\System32\drivers\SmartConnectDriver.sys	Mapper.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

Registry Run Keys / Startup Folder

Modify Registry

Windows Service

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PdFwKrnl\ImagePath = "\\??\\C:\\Windows\\System32\\drivers\\CoreDeviceDriver.sys"	Mapper.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3224	taskkill.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
5028	Mapper.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	5028	Mapper.exe
Token: SeDebugPrivilege	3224	taskkill.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 4724	5028	Mapper.exe	85
PID 5028 wrote to memory of 5448	5028	Mapper.exe	90
PID 5448 wrote to memory of 3224	5448	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\Release\Mapper.exe
"C:\Users\Admin\AppData\Local\Temp\Release\Mapper.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /F /IM WmiPrvSE.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5448
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM WmiPrvSE.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3224

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2872