Analysis
-
max time kernel
19s -
max time network
12s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
05/08/2024, 20:31
General
-
Target
rQuPlMBadLDa.exe
-
Size
17.0MB
-
MD5
4f65fbcb1bd6e3a5ee4fba9d17ac993e
-
SHA1
7c9eb87236238592dc75672ee8e9cddc7fcaf299
-
SHA256
e8bc99409ca504f4292f62395df0a28cffb4fe1768b5f2cfe50f8ed1e996f0d4
-
SHA512
7c455ea1deb3a6c3404527a8fd93566c14e6c2c521ba944a654d385886c2ae6e15460b066187e10da9ea42013f216b1deae9e34d526c60cfce1ca53c3de91461
-
SSDEEP
393216:v4Tr/lg+4jMC83Oxi8QYp29pazxeUaCkTN2FQcEO2nRL:v4TxaICZxiK290zxxeMFNE
Score
7/10
Malware Config
Signatures
-
Themida packer 2 IoCs
Detects Themida, an advanced Windows software protection system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\rQuPlMBadLDa.exe"C:\Users\Admin\AppData\Local\Temp\rQuPlMBadLDa.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.6MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
34.5MB
-
Filesize
6.6MB
-
Filesize
34.5MB