Analysis

  • max time kernel
    13s
  • max time network
    14s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/06/2024, 23:45

General

  • Target

    thraxv2.exe

  • Size

    66.6MB

  • MD5

    b97a9d91e3f7a275e5b4f29de356b2fb

  • SHA1

    8f12afb3d4a93847e918b5402af22621acf957bd

  • SHA256

    ad30658ce6a1789a1aba53be2ce805f544f32ad754fa131d8ee221f362cc93f0

  • SHA512

    b5e8d75220fd2bceb9a838d54b75432067393332b256b45391958e8e77845b9f3c72b82749017768a90cb38ae757cad2ddb835bb588fe6a421b3086550dad002

  • SSDEEP

    1572864:k7T5M6A29Cr0WIOfZL1GzvZeXjI4PWthlP5h8h:cqB29BifF1IvZez1Wt

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\thraxv2.exe
    "C:\Users\Admin\AppData\Local\Temp\thraxv2.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5484
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\thraxv2.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1208
      • C:\Windows\system32\certutil.exe
        certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\thraxv2.exe" MD5
        3⤵
          PID:4332
        • C:\Windows\system32\find.exe
          find /i /v "md5"
          3⤵
            PID:3472
          • C:\Windows\system32\find.exe
            find /i /v "certutil"
            3⤵
              PID:2780

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/5484-0-0x00007FFE5ED50000-0x00007FFE5ED52000-memory.dmp

          Filesize

          8KB

        • memory/5484-1-0x00007FFE5ED60000-0x00007FFE5ED62000-memory.dmp

          Filesize

          8KB

        • memory/5484-6-0x0000000140188000-0x00000001430AF000-memory.dmp

          Filesize

          47.2MB

        • memory/5484-2-0x0000000140000000-0x0000000141000000-memory.dmp

          Filesize

          16.0MB

        • memory/5484-7-0x0000000140188000-0x00000001430AF000-memory.dmp

          Filesize

          47.2MB