e38c8d08061b99f3114671cbb0655d02630dd21d8da52a8a1dcde1cc746b8c05 | Triage

Analysis

max time kernel
14s
max time network
7s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
25-04-2024 19:26

Sharing

Report Analysis Logs

General

Target

standatnik elyxloader.exe
Size

3.2MB
MD5

6689fb231fe7bfd09e9ff00db07ce799
SHA1

919f63868fbc21a18765ab69e5adf998b9d9c590
SHA256

e38c8d08061b99f3114671cbb0655d02630dd21d8da52a8a1dcde1cc746b8c05
SHA512

4d998c5b5719c48b81002cd68933d2dff705400d106c0ad008be6625250e8fa8cf6b36a835c156ad98bdcaeab5c50bc64f9c6dba7843416751912d0452d196af
SSDEEP

98304:X0OKd4XOe5UPkZrhCs77tjbkuUcz+D/dl:E9GOe2kvCsftjnu

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5708	standatnik elyxloader.exe
5708	standatnik elyxloader.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5708	standatnik elyxloader.exe
5708	standatnik elyxloader.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5708	standatnik elyxloader.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5708	standatnik elyxloader.exe

C:\Users\Admin\AppData\Local\Temp\standatnik elyxloader.exe
"C:\Users\Admin\AppData\Local\Temp\standatnik elyxloader.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5708-1-0x0000000000400000-0x0000000000AEE000-memory.dmp

Filesize
6.9MB

Download
memory/5708-0-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download
memory/5708-3-0x0000000000400000-0x0000000000AEE000-memory.dmp

Filesize
6.9MB

Download