Analysis

  • max time kernel
    127s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-08-2023 20:55

General

  • Target

    modest-menu_v0.9.10/modest-menu.exe

  • Size

    14.3MB

  • MD5

    f0851119cec15d35a8f206f1ba446f86

  • SHA1

    5ff263672af7e81a344846b3bce1ff4e59f8b6cd

  • SHA256

    19a82f12d86829e768d226c0ec5e20a664f349d1bbabd3aaeade3ff3d7237282

  • SHA512

    2ccbe9d55b59bc22ce615f23a09baa66d15e88f7c44e8f5561c54b410d02cb309d40865fd22694470fc9cfbda69ad12fb699427778347e49db63d60a341cf5ea

  • SSDEEP

    393216:rO4LKZjqtG+kh/JUwReHLsLjbeeE8KohlBM2Dd1rzO:rrKZjLhDUHimEJhD

Score
7/10

Malware Config

Signatures

  • Themida packer 10 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\modest-menu_v0.9.10\modest-menu.exe
    "C:\Users\Admin\AppData\Local\Temp\modest-menu_v0.9.10\modest-menu.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:3860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3860-133-0x00007FF7CEB00000-0x00007FF7D0F2F000-memory.dmp

    Filesize

    36.2MB

  • memory/3860-134-0x00007FFDFDE50000-0x00007FFDFE045000-memory.dmp

    Filesize

    2.0MB

  • memory/3860-135-0x00007FF7CEB00000-0x00007FF7D0F2F000-memory.dmp

    Filesize

    36.2MB

  • memory/3860-136-0x00007FF7CEB00000-0x00007FF7D0F2F000-memory.dmp

    Filesize

    36.2MB

  • memory/3860-137-0x00007FF7CEB00000-0x00007FF7D0F2F000-memory.dmp

    Filesize

    36.2MB

  • memory/3860-138-0x00007FF7CEB00000-0x00007FF7D0F2F000-memory.dmp

    Filesize

    36.2MB

  • memory/3860-139-0x00007FF7CEB00000-0x00007FF7D0F2F000-memory.dmp

    Filesize

    36.2MB

  • memory/3860-140-0x00007FF7CEB00000-0x00007FF7D0F2F000-memory.dmp

    Filesize

    36.2MB

  • memory/3860-141-0x00007FF7CEB00000-0x00007FF7D0F2F000-memory.dmp

    Filesize

    36.2MB

  • memory/3860-142-0x00007FF7CEB00000-0x00007FF7D0F2F000-memory.dmp

    Filesize

    36.2MB

  • memory/3860-143-0x00007FF7CEB00000-0x00007FF7D0F2F000-memory.dmp

    Filesize

    36.2MB

  • memory/3860-144-0x00007FFDFDE50000-0x00007FFDFE045000-memory.dmp

    Filesize

    2.0MB