Resubmissions

14-05-2024 03:26

240514-dzbfeshe54 1

26-04-2024 21:38

240426-1g6vyade6y 1

Analysis

  • max time kernel
    102s
  • max time network
    106s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-05-2024 03:26

General

  • Target

    2024-04-26_fe94c576b99dcc99b1c82fce00af97ab_snatch.exe

  • Size

    28.2MB

  • MD5

    fe94c576b99dcc99b1c82fce00af97ab

  • SHA1

    aea717754ba2ba8fb3981bb87837b150ab659023

  • SHA256

    3e20143e3e6346e09009109c997e91ce135eafc20496a02b2d5bad4a0b2a823c

  • SHA512

    9bfbc9063924c61a5fe5338ea7c332d764575d62e80ac20356a9d10901b40266dd536d19274302ddf1cdc8b92fdb9c0bda4d807ef012d55db7f5e28453b16b34

  • SSDEEP

    98304:FNE2/fNpo5pemooOoC3iQ5Ao2oPOt6rv8TT5bNGcP/NT41ue+ROhNZkJKfyq1t4C:DE2/CemooOoyz5XPOv5svw1B6

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-26_fe94c576b99dcc99b1c82fce00af97ab_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-26_fe94c576b99dcc99b1c82fce00af97ab_snatch.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Users\Admin\AppData\Local\Temp\2024-04-26_fe94c576b99dcc99b1c82fce00af97ab_snatch.exe
      C:\Users\Admin\AppData\Local\Temp\2024-04-26_fe94c576b99dcc99b1c82fce00af97ab_snatch.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4576
    • C:\Windows\system32\cmd.exe
      cmd.exe /K
      2⤵
        PID:3632

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads