cb4163dbaf810fc3487b051887f5c6d126b65565d64700c8383cbf8f9b32d71d

Analysis

max time kernel
141s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11-02-2024 12:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/EPM.exe
Size

1.4MB
MD5

9bdff46961aef386d4de5e2b1405dc40
SHA1

c6ef1ed87c331a8bd1cd1adaf5aa5d124d677bc3
SHA256

d8e43dfb7662e0eeb26821f5a6a8d9f8a5b351d1d1e769a516ed65b86144e605
SHA512

2651383f0fda8fe3c1ab7ea1335d1a0680b1bc52e33b4d66fab9fadf00f350e793392930c4a34838ec5fc98d1c92657a75170602b792158a88e3efcbc84feb8d
SSDEEP

24576:llwhPNBDi2j1/m9+8N5n+Rj4YM7D4OnvHIHeev9Gvxa6uG2g1uv:laNE2Jdm57YMI6voHhKR/71uv

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2196	EPM.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2196	EPM.exe

C:\Users\Admin\AppData\Local\Temp\$TEMP\EPM.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\EPM.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2196-1-0x0000000000400000-0x0000000000815000-memory.dmp

Filesize
4.1MB

Download
memory/2196-0-0x0000000000400000-0x0000000000815000-memory.dmp

Filesize
4.1MB

Download
memory/2196-3-0x0000000000400000-0x0000000000815000-memory.dmp

Filesize
4.1MB

Download
memory/2196-4-0x00000000003F0000-0x00000000003F3000-memory.dmp

Filesize
12KB

Download
memory/2196-5-0x0000000000400000-0x0000000000815000-memory.dmp

Filesize
4.1MB

Download
memory/2196-7-0x0000000000400000-0x0000000000815000-memory.dmp

Filesize
4.1MB

Download
memory/2196-8-0x0000000000400000-0x0000000000815000-memory.dmp

Filesize
4.1MB

Download
memory/2196-10-0x0000000000A00000-0x0000000000A04000-memory.dmp

Filesize
16KB

Download
memory/2196-11-0x00000000009B0000-0x00000000009F9000-memory.dmp

Filesize
292KB

Download
memory/2196-9-0x0000000000400000-0x0000000000815000-memory.dmp

Filesize
4.1MB

Download
memory/2196-6-0x00000000009B0000-0x00000000009F9000-memory.dmp

Filesize
292KB

Download
memory/2196-12-0x0000000000400000-0x0000000000815000-memory.dmp

Filesize
4.1MB

Download
memory/2196-14-0x0000000000A90000-0x0000000000A91000-memory.dmp

Filesize
4KB

Download
memory/2196-13-0x0000000000400000-0x0000000000815000-memory.dmp

Filesize
4.1MB

Download
memory/2196-15-0x0000000000400000-0x0000000000815000-memory.dmp

Filesize
4.1MB

Download
memory/2196-16-0x0000000000400000-0x0000000000815000-memory.dmp

Filesize
4.1MB

Download
memory/2196-18-0x0000000000400000-0x0000000000815000-memory.dmp

Filesize
4.1MB

Download
memory/2196-19-0x0000000000A00000-0x0000000000A04000-memory.dmp

Filesize
16KB

Download
memory/2196-17-0x0000000000400000-0x0000000000815000-memory.dmp

Filesize
4.1MB

Download
memory/2196-20-0x0000000000400000-0x0000000000815000-memory.dmp

Filesize
4.1MB

Download
memory/2196-21-0x00000000009B0000-0x00000000009F9000-memory.dmp

Filesize
292KB

Download
memory/2196-22-0x0000000000400000-0x0000000000815000-memory.dmp

Filesize
4.1MB

Download
memory/2196-24-0x0000000000400000-0x0000000000815000-memory.dmp

Filesize
4.1MB

Download
memory/2196-27-0x0000000000400000-0x0000000000815000-memory.dmp

Filesize
4.1MB

Download
memory/2196-29-0x0000000000400000-0x0000000000815000-memory.dmp

Filesize
4.1MB

Download