Analysis

  • max time kernel
    91s
  • max time network
    102s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-06-2024 07:58

General

  • Target

    SakuraaCastingModLoader.exe

  • Size

    13.8MB

  • MD5

    1ed98e2aa5685c02c6e901100353e556

  • SHA1

    5ac2b2ae4f91122a1d1722a4dd7e535077885a10

  • SHA256

    9fd82b4b337ef2dadc453aa0365b3f3fb372de592df7bae33a041e4f2698b54c

  • SHA512

    bcd43029cce581b3e776be5d1a58c89d0a752a12b04c2ac63939a9f94fd3190538cc873f6e0ff1910858c70d8c97f192ad2c5c39caa6bc94dcabde423024c945

  • SSDEEP

    393216:fftZJkZJH84iNGcGOrsN1Do840BvsDv2A7S:HtZJaJ7is3OYNTBK1S

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SakuraaCastingModLoader.exe
    "C:\Users\Admin\AppData\Local\Temp\SakuraaCastingModLoader.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:3268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3268-0-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

    Filesize

    2.0MB

  • memory/3268-1-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

    Filesize

    2.0MB

  • memory/3268-2-0x00007FFC16430000-0x00007FFC16432000-memory.dmp

    Filesize

    8KB

  • memory/3268-3-0x00007FFC16440000-0x00007FFC16442000-memory.dmp

    Filesize

    8KB

  • memory/3268-4-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

    Filesize

    2.0MB

  • memory/3268-5-0x00007FF77ADF0000-0x00007FF77C3EC000-memory.dmp

    Filesize

    22.0MB