Analysis
-
max time kernel
294s -
max time network
300s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
20/06/2024, 23:40
Static task
static1
Behavioral task
behavioral1
Sample
e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe
Resource
win10-20240404-en
General
-
Target
e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe
-
Size
1.3MB
-
MD5
ff10866584c65b97da14051357bb81e0
-
SHA1
421400516c3075999934fabcaa2a3fb398fa0128
-
SHA256
e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c
-
SHA512
814829d5a8ee369da2d65f5fd9e458483b36e4b97b1da5265af122cdd27d5b9a3cb1cd968e3d061496140f4626f00dfe6dddc517bf41979c5186d562127c1499
-
SSDEEP
24576:QWseOknDWF5QrtEBtbZ87NpFvPAcwQwPyEvODQs9Pk4npa:aknyF5Re7vBPAclw48s9Pkc
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 30 IoCs
pid Process 3936 e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe 3936 e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe 3936 e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe 3936 e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe 3936 e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe 3936 e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe 3936 e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe 3936 e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe 3936 e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe 3936 e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe 3936 e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe 3936 e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe 3936 e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe 3936 e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe 3936 e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe 3936 e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe 3936 e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe 3936 e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe 3936 e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe 3936 e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe 3936 e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe 3936 e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe 3936 e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe 3936 e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe 3936 e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe 3936 e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe 3936 e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe 3936 e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe 3936 e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe 3936 e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3936 e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe"C:\Users\Admin\AppData\Local\Temp\e8fa8c508dd07c17b2ee3fa9a5ca38d53308a67b00e303d97c79b3d2190a201c.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:3936