Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-05-2024 18:37

General

  • Target

    ecce1ba9138f531490fd08a9473b07855cffeaea5e648ce304dc365142bec1bf.exe

  • Size

    5.8MB

  • MD5

    93ca202a374b40b6ff7730024c7f60eb

  • SHA1

    7020d863f5184fbf91a6b966ea8158d80b1a97a4

  • SHA256

    ecce1ba9138f531490fd08a9473b07855cffeaea5e648ce304dc365142bec1bf

  • SHA512

    2bbfaf64e6e1ad2b00c7ceff4630ad6333079f1ac5476429050bcf835c30717ece23b49f9d8264881ecc968046ac7c18ebc6228a199338bf367aa160cf2e6196

  • SSDEEP

    98304:L0fJMpA1AdDHLe4TZZ5se5ZFUwVhr6TMKaulepCAtCOxtlGd/3ssbj1G/oh5uWZP:L0y2AdDrh355r6wxpC68hpPuW6qusB

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ecce1ba9138f531490fd08a9473b07855cffeaea5e648ce304dc365142bec1bf.exe
    "C:\Users\Admin\AppData\Local\Temp\ecce1ba9138f531490fd08a9473b07855cffeaea5e648ce304dc365142bec1bf.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3192-0-0x000000000057E000-0x00000000008EE000-memory.dmp

    Filesize

    3.4MB

  • memory/3192-8-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

    Filesize

    4KB

  • memory/3192-12-0x0000000000400000-0x0000000000EBA000-memory.dmp

    Filesize

    10.7MB

  • memory/3192-13-0x0000000000400000-0x0000000000EBA000-memory.dmp

    Filesize

    10.7MB

  • memory/3192-7-0x0000000002DC0000-0x0000000002DC1000-memory.dmp

    Filesize

    4KB

  • memory/3192-6-0x00000000014F0000-0x00000000014F1000-memory.dmp

    Filesize

    4KB

  • memory/3192-5-0x00000000014E0000-0x00000000014E1000-memory.dmp

    Filesize

    4KB

  • memory/3192-4-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

    Filesize

    4KB

  • memory/3192-3-0x0000000000F90000-0x0000000000F91000-memory.dmp

    Filesize

    4KB

  • memory/3192-2-0x0000000000F80000-0x0000000000F81000-memory.dmp

    Filesize

    4KB

  • memory/3192-1-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

    Filesize

    4KB

  • memory/3192-14-0x000000000057E000-0x00000000008EE000-memory.dmp

    Filesize

    3.4MB

  • memory/3192-15-0x0000000000400000-0x0000000000EBA000-memory.dmp

    Filesize

    10.7MB