Analysis

  • max time kernel
    141s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-12-2023 19:43

General

  • Target

    0e6c4a7c9b649b4b511b39a76248d506.exe

  • Size

    4.4MB

  • MD5

    0e6c4a7c9b649b4b511b39a76248d506

  • SHA1

    6dab5f918c20d8f43f2052a1043f4a5387599fd1

  • SHA256

    e2884b5661c11864376fd36dc47ef22e2f809c57529c4efe15131a64a7a38e6c

  • SHA512

    71c5565ca2e5fbba1e987ad28e04480cca7caa6e2804742284f51c57fbc6401481835e78543cebf5484a4b8d5d8d0b96fbd70cded0c79c377d20dffeb7913da3

  • SSDEEP

    49152:kqWJLFHPYzdVy43kz6rcViF9hBjSZxtvxPscNznmAMCz0BAjKWsl98Q1F0foUci0:kbzvYzCgHjSbscNCpBAjPogw9qa3IPk

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0e6c4a7c9b649b4b511b39a76248d506.exe
    "C:\Users\Admin\AppData\Local\Temp\0e6c4a7c9b649b4b511b39a76248d506.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:2864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2864-0-0x0000000000400000-0x0000000001056000-memory.dmp

    Filesize

    12.3MB

  • memory/2864-1-0x0000000077270000-0x0000000077271000-memory.dmp

    Filesize

    4KB

  • memory/2864-2-0x0000000000400000-0x0000000001056000-memory.dmp

    Filesize

    12.3MB