f18f95a8e182a61bd92cec812a0364301fbe622f2d1e550b60a4337c2582e2cc | Triage

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 05:20

Sharing

Report Analysis Logs

General

Target

c513521248c4f1252257ad1fe349ffc0.exe
Size

4.1MB
MD5

c513521248c4f1252257ad1fe349ffc0
SHA1

44246ba434eb8d2b53a4f2eb87e42253e6b9cdd8
SHA256

f18f95a8e182a61bd92cec812a0364301fbe622f2d1e550b60a4337c2582e2cc
SHA512

d356d3b206ef2f3ba4207ab112fa1f994c3032361c3941598d5ba4de520cfabf42fe529ab9bc533b5e3deff4a89198a6ee8379b00a1ae7a96180cedbee734eee
SSDEEP

98304:oWYQw0HFkjtuEK3ThtRlD2ffbu5O34kkb:oWYd0HWoXRiu5Zk8

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4780	c513521248c4f1252257ad1fe349ffc0.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4780	c513521248c4f1252257ad1fe349ffc0.exe
4780	c513521248c4f1252257ad1fe349ffc0.exe
4780	c513521248c4f1252257ad1fe349ffc0.exe
4780	c513521248c4f1252257ad1fe349ffc0.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4780	c513521248c4f1252257ad1fe349ffc0.exe

C:\Users\Admin\AppData\Local\Temp\c513521248c4f1252257ad1fe349ffc0.exe
"C:\Users\Admin\AppData\Local\Temp\c513521248c4f1252257ad1fe349ffc0.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4780-0-0x0000000000400000-0x0000000001049000-memory.dmp

Filesize
12.3MB

Download
memory/4780-1-0x0000000001170000-0x0000000001171000-memory.dmp

Filesize
4KB

Download
memory/4780-2-0x0000000000400000-0x0000000001049000-memory.dmp

Filesize
12.3MB

Download