Analysis

  • max time kernel
    134s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/05/2024, 04:08

General

  • Target

    57730879780ee1a21288d9f2e4b66512fad590a12544198e6ae4d8c7a943c10d.exe

  • Size

    7.3MB

  • MD5

    ce3343369a056c3b03e8d79c5f75b8ac

  • SHA1

    accb23f3b99e59dd4c18890736b17daa748a76ce

  • SHA256

    57730879780ee1a21288d9f2e4b66512fad590a12544198e6ae4d8c7a943c10d

  • SHA512

    67108924654cddbd1019b3b879d6a902f2f65d190a93dc8c56a20ad88f9560d27f025c92217391d5239c6d23d5f0fb61dae3465f82e2dec028860d67b0b791f1

  • SSDEEP

    98304:WPdag2WaDaxXmpdFDNzdRT1stBK8+dSoo0tOkVGCVuZujuRKe2QvoYbjuZBhKm79:WPsg2WaDaxKfxJRT1OEdDoE/8LnSBrm

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\57730879780ee1a21288d9f2e4b66512fad590a12544198e6ae4d8c7a943c10d.exe
    "C:\Users\Admin\AppData\Local\Temp\57730879780ee1a21288d9f2e4b66512fad590a12544198e6ae4d8c7a943c10d.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2408

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2408-0-0x000000000062C000-0x0000000000A8D000-memory.dmp

          Filesize

          4.4MB

        • memory/2408-9-0x0000000000400000-0x00000000011E4000-memory.dmp

          Filesize

          13.9MB

        • memory/2408-8-0x0000000003100000-0x0000000003101000-memory.dmp

          Filesize

          4KB

        • memory/2408-7-0x00000000030F0000-0x00000000030F1000-memory.dmp

          Filesize

          4KB

        • memory/2408-6-0x00000000030E0000-0x00000000030E1000-memory.dmp

          Filesize

          4KB

        • memory/2408-5-0x00000000030D0000-0x00000000030D1000-memory.dmp

          Filesize

          4KB

        • memory/2408-4-0x00000000018F0000-0x00000000018F1000-memory.dmp

          Filesize

          4KB

        • memory/2408-3-0x00000000018D0000-0x00000000018D1000-memory.dmp

          Filesize

          4KB

        • memory/2408-2-0x00000000018C0000-0x00000000018C1000-memory.dmp

          Filesize

          4KB

        • memory/2408-1-0x0000000001240000-0x0000000001241000-memory.dmp

          Filesize

          4KB

        • memory/2408-11-0x0000000000400000-0x00000000011E4000-memory.dmp

          Filesize

          13.9MB

        • memory/2408-13-0x0000000000400000-0x00000000011E4000-memory.dmp

          Filesize

          13.9MB

        • memory/2408-14-0x0000000000400000-0x00000000011E4000-memory.dmp

          Filesize

          13.9MB

        • memory/2408-15-0x000000000062C000-0x0000000000A8D000-memory.dmp

          Filesize

          4.4MB