Analysis

  • max time kernel
    92s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/06/2024, 09:08

General

  • Target

    病毒样本/b267-53a.exe

  • Size

    6.7MB

  • MD5

    bd0cbfea61691598a28996a604229ccc

  • SHA1

    5c4ed76d0008bdd0de4fb04ebbcf51c2aebce428

  • SHA256

    f85e22d66bd781c86c0ca3331341109856f03c4dec3c9e54fa84f11be3f88900

  • SHA512

    fdb824caad07b7f16a18753d2f3bba2a8e82fdff13afd2832a3d82ee727daa9a6ea018458f618d8c68538280b703ee5b5e820fb4a094a27d2b58ddb05d0724a8

  • SSDEEP

    196608:wxtKdGviCH4360TB+OqLkq2u9ygz0zx4:otZqM4360tq2Uz0z

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\病毒样本\b267-53a.exe
    "C:\Users\Admin\AppData\Local\Temp\病毒样本\b267-53a.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:4368

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/4368-1-0x00000000000C0000-0x0000000000C7E000-memory.dmp

          Filesize

          11.7MB

        • memory/4368-3-0x00000000001C9000-0x00000000005D5000-memory.dmp

          Filesize

          4.0MB

        • memory/4368-0-0x00000000011D0000-0x00000000011D1000-memory.dmp

          Filesize

          4KB

        • memory/4368-5-0x0000000001200000-0x0000000001214000-memory.dmp

          Filesize

          80KB

        • memory/4368-12-0x00000000001C9000-0x00000000005D5000-memory.dmp

          Filesize

          4.0MB

        • memory/4368-13-0x00000000000C0000-0x0000000000C7E000-memory.dmp

          Filesize

          11.7MB

        • memory/4368-14-0x00000000001C9000-0x00000000005D5000-memory.dmp

          Filesize

          4.0MB

        • memory/4368-15-0x00000000000C0000-0x0000000000C7E000-memory.dmp

          Filesize

          11.7MB