Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-07-2024 14:20

General

  • Target

    FGESP.exe

  • Size

    17.8MB

  • MD5

    ce4df95272f586feb6b56c9ddd27476f

  • SHA1

    3bcc590385e9de9aa2ea4d7b63ab6b7d82ff28ab

  • SHA256

    594dbfd728a7619fe03a4e29fb15e01792fbe8e3fa8dd1c1050b495e2c7a2acb

  • SHA512

    f83513534decd21851f981d7170ba7b737d9296534f5815f24593982450a89346d5152d7a1f7a329017dde1637d4fd8066be706cb0c320b12bb05056f2bc18b7

  • SSDEEP

    393216:wNWvowPBZA7GjTKVnqmu26jTHzokkj5yQMxyQ2zMsXfTuC6F8laO+:GIZcCyArjTkZF+ycsvT9

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FGESP.exe
    "C:\Users\Admin\AppData\Local\Temp\FGESP.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/940-1-0x00007FF653A00000-0x00007FF654BB0000-memory.dmp

    Filesize

    17.7MB

  • memory/940-2-0x00007FF654B95000-0x00007FF654BB0000-memory.dmp

    Filesize

    108KB

  • memory/940-0-0x00007FF653A00000-0x00007FF654BB0000-memory.dmp

    Filesize

    17.7MB

  • memory/940-3-0x00007FF653A00000-0x00007FF654BB0000-memory.dmp

    Filesize

    17.7MB

  • memory/940-6-0x00007FF653A00000-0x00007FF654BB0000-memory.dmp

    Filesize

    17.7MB

  • memory/940-4-0x00007FF653A00000-0x00007FF654BB0000-memory.dmp

    Filesize

    17.7MB

  • memory/940-5-0x00007FF653A00000-0x00007FF654BB0000-memory.dmp

    Filesize

    17.7MB

  • memory/940-13-0x00007FF654B95000-0x00007FF654BB0000-memory.dmp

    Filesize

    108KB

  • memory/940-8-0x0000021382940000-0x000002138299C000-memory.dmp

    Filesize

    368KB

  • memory/940-7-0x00007FF653A00000-0x00007FF654BB0000-memory.dmp

    Filesize

    17.7MB

  • memory/940-12-0x00007FF653A00000-0x00007FF654BB0000-memory.dmp

    Filesize

    17.7MB