Analysis
-
max time kernel
300s -
max time network
303s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
20/06/2024, 22:42
Static task
static1
Behavioral task
behavioral1
Sample
418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe
Resource
win10-20240404-en
General
-
Target
418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe
-
Size
1.3MB
-
MD5
1ec84968e266692c9210bf7cf1f4c65c
-
SHA1
424533789137bccd60dc29697f8c83025bdffcbb
-
SHA256
418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896
-
SHA512
27e7f86d88bf7002e7d56f2a74b120751f4781e73d707a24ecb085654f163d4ec4e992552ec6ef2d4bca8e0132adc1e5782d529edfcac94ca516b264c1bb2b6a
-
SSDEEP
24576:b2z2tyVdacEiqRicd+lAkReFIhHTXkeWlPJCwQJiyIakELJXe166U4akLjvee7J:az2EPacEi/4hFEahClQL86fLakPvb7
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 30 IoCs
pid Process 4692 418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe 4692 418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe 4692 418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe 4692 418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe 4692 418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe 4692 418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe 4692 418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe 4692 418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe 4692 418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe 4692 418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe 4692 418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe 4692 418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe 4692 418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe 4692 418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe 4692 418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe 4692 418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe 4692 418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe 4692 418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe 4692 418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe 4692 418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe 4692 418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe 4692 418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe 4692 418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe 4692 418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe 4692 418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe 4692 418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe 4692 418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe 4692 418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe 4692 418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe 4692 418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4692 418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe"C:\Users\Admin\AppData\Local\Temp\418eb199fefe645574337bc8a468d3f4ffcda89b9755038157c07f4eac0a8896.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:4692