Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06-09-2024 19:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
LAUNCHER(1).exe
Resource
win7-20240729-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
LAUNCHER(1).exe
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
LAUNCHER(1).exe
-
Size
26.5MB
-
MD5
2b9574243ce737564c4d808a471b33b8
-
SHA1
c6a7dbe1bc73ff72c137cdc896c746e77df2ce80
-
SHA256
225c8a3cab0e7b7cf52596a822ecaf75f7826ff89f0e58df190118b988699e8a
-
SHA512
5c7aa363baa56d99a79a80f29c5b1d79c5f3ebf359d33e1770d590fa2ad571f32298e4159c02254db3596ab3c82b03dc02a772d41764391d3caba8e738bf60d3
-
SSDEEP
786432:bHGtKH1jlC42OaZSKNBWkGoCsoM5JX8e:bHGSJ34ZBWkIsoMHX
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2844 LAUNCHER(1).exe 2844 LAUNCHER(1).exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2844 LAUNCHER(1).exe 2844 LAUNCHER(1).exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\LAUNCHER(1).exe"C:\Users\Admin\AppData\Local\Temp\LAUNCHER(1).exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2844
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2600