4a9d64583260db1c1e4ff7d763341a1ab2bdf1d6e840dd622efad07da12a1d32 | Triage

Analysis

max time kernel
138s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 13:20

Sharing

Report Analysis Logs

General

Target

Celestial.exe
Size

9.4MB
MD5

86cae458b120a8c8f336d30590cc3c4f
SHA1

68f0a11a37c01f79db978ef19c03ee9c3457a6db
SHA256

4a9d64583260db1c1e4ff7d763341a1ab2bdf1d6e840dd622efad07da12a1d32
SHA512

489eb0bc1d465c713e4670a2743499ed256bd535332e211fd37f900f3d4a707c35d9dbee391e33d07eb4a9421f4312f74ecaf924f0b86ddecfe4190186093dbb
SSDEEP

196608:8o/0CasEDPZ2lB54SY3KTBRYIzH7IXB0wnlnmELgaJitOsFo:8o/TTAPcf5Bqa3zzH7IB00nn4OsFo

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

Processes:

resource	yara_rule
behavioral2/memory/2700-1-0x0000014B97DC0000-0x0000014B99300000-memory.dmp	themida

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

Celestial.exe

pid process

2700 Celestial.exe

C:\Users\Admin\AppData\Local\Temp\Celestial.exe
"C:\Users\Admin\AppData\Local\Temp\Celestial.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2700-0-0x00007FF844743000-0x00007FF844745000-memory.dmp

Filesize
8KB

Download
memory/2700-1-0x0000014B97DC0000-0x0000014B99300000-memory.dmp

Filesize
21.2MB

Download
memory/2700-2-0x0000014B9AE50000-0x0000014B9AE51000-memory.dmp

Filesize
4KB

Download