Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 18:37
Static task
static1
Behavioral task
behavioral1
Sample
ecce1ba9138f531490fd08a9473b07855cffeaea5e648ce304dc365142bec1bf.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
ecce1ba9138f531490fd08a9473b07855cffeaea5e648ce304dc365142bec1bf.exe
Resource
win10v2004-20240426-en
General
-
Target
ecce1ba9138f531490fd08a9473b07855cffeaea5e648ce304dc365142bec1bf.exe
-
Size
5.8MB
-
MD5
93ca202a374b40b6ff7730024c7f60eb
-
SHA1
7020d863f5184fbf91a6b966ea8158d80b1a97a4
-
SHA256
ecce1ba9138f531490fd08a9473b07855cffeaea5e648ce304dc365142bec1bf
-
SHA512
2bbfaf64e6e1ad2b00c7ceff4630ad6333079f1ac5476429050bcf835c30717ece23b49f9d8264881ecc968046ac7c18ebc6228a199338bf367aa160cf2e6196
-
SSDEEP
98304:L0fJMpA1AdDHLe4TZZ5se5ZFUwVhr6TMKaulepCAtCOxtlGd/3ssbj1G/oh5uWZP:L0y2AdDrh355r6wxpC68hpPuW6qusB
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 3192 ecce1ba9138f531490fd08a9473b07855cffeaea5e648ce304dc365142bec1bf.exe 3192 ecce1ba9138f531490fd08a9473b07855cffeaea5e648ce304dc365142bec1bf.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3192 ecce1ba9138f531490fd08a9473b07855cffeaea5e648ce304dc365142bec1bf.exe 3192 ecce1ba9138f531490fd08a9473b07855cffeaea5e648ce304dc365142bec1bf.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3192 ecce1ba9138f531490fd08a9473b07855cffeaea5e648ce304dc365142bec1bf.exe 3192 ecce1ba9138f531490fd08a9473b07855cffeaea5e648ce304dc365142bec1bf.exe 3192 ecce1ba9138f531490fd08a9473b07855cffeaea5e648ce304dc365142bec1bf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ecce1ba9138f531490fd08a9473b07855cffeaea5e648ce304dc365142bec1bf.exe"C:\Users\Admin\AppData\Local\Temp\ecce1ba9138f531490fd08a9473b07855cffeaea5e648ce304dc365142bec1bf.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3192