Analysis
-
max time kernel
298s -
max time network
300s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
08/05/2024, 22:41
Static task
static1
Behavioral task
behavioral1
Sample
244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe
Resource
win10-20240404-en
General
-
Target
244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe
-
Size
3.0MB
-
MD5
13d5914654d4cb8bc7f83755d869ae61
-
SHA1
7e9816c9174b8bacc95a92f6bd84117455d072a9
-
SHA256
244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f
-
SHA512
7515b4b00a7b58b1accd78cc518ec64e79777305ddcdb4b35d2fe0894032ee2b2dcb395d2829acde009e8070e19f9513a7df7f78aa6874d32e7d861b367ce7bd
-
SSDEEP
98304:/l7/Qdmr0MIE8qigzwNAktNpP1SuJEXq9t4MPf0PelR:dsdmguigzwNAktYBAt4je
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 31 IoCs
pid Process 4140 244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe 4140 244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe 4140 244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe 4140 244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe 4140 244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe 4140 244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe 4140 244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe 4140 244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe 4140 244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe 4140 244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe 4140 244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe 4140 244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe 4140 244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe 4140 244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe 4140 244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe 4140 244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe 4140 244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe 4140 244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe 4140 244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe 4140 244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe 4140 244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe 4140 244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe 4140 244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe 4140 244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe 4140 244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe 4140 244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe 4140 244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe 4140 244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe 4140 244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe 4140 244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe 4140 244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4140 244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe"C:\Users\Admin\AppData\Local\Temp\244a210d981a510ddb06a8608f33e381455c4974ef8f7d04c0a6b1b4b03b7f2f.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:4140