Analysis

  • max time kernel
    90s
  • max time network
    96s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    13-09-2024 10:20

General

  • Target

    ZoraraUI.exe

  • Size

    254KB

  • MD5

    6ab5f40d4b2b76c00171e56c152cbaf9

  • SHA1

    9c38466e663505562c3717a23961fe3bd349896d

  • SHA256

    ffae17497d4fb9c5b213172fa06488951cc9d4af6900e20cea97c7371e17187f

  • SHA512

    0c27ac1d1e71777e04b955eb327837d28030ef06db0272262bf36415b035e763f803ffbee7626ff17cbfec9145925c7cd6740a7b7203e65c403ac34b05fc1abe

  • SSDEEP

    3072:GjK4UGDHXrQ8hy7qgpHulWD9ZvZ5Pf3Ca10xuZ04ntfOBhBu+mYwSKgIwB:GjK4TDUqgpqWDLZ5H+xuZ04ihA+N

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ZoraraUI.exe
    "C:\Users\Admin\AppData\Local\Temp\ZoraraUI.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:3892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3892-0-0x00007FFB8FCB7000-0x00007FFB90442000-memory.dmp

    Filesize

    7.5MB

  • memory/3892-2-0x00007FFBB5E60000-0x00007FFBB5E62000-memory.dmp

    Filesize

    8KB

  • memory/3892-5-0x00007FFBB5E80000-0x00007FFBB5E82000-memory.dmp

    Filesize

    8KB

  • memory/3892-8-0x00007FFBB34B0000-0x00007FFBB34B2000-memory.dmp

    Filesize

    8KB

  • memory/3892-7-0x00007FFBB58E0000-0x00007FFBB58E2000-memory.dmp

    Filesize

    8KB

  • memory/3892-6-0x00007FFBB58D0000-0x00007FFBB58D2000-memory.dmp

    Filesize

    8KB

  • memory/3892-4-0x00007FFB8FBE0000-0x00007FFB9108B000-memory.dmp

    Filesize

    20.7MB

  • memory/3892-3-0x00007FFBB5E70000-0x00007FFBB5E72000-memory.dmp

    Filesize

    8KB

  • memory/3892-1-0x00007FFBB5E50000-0x00007FFBB5E52000-memory.dmp

    Filesize

    8KB

  • memory/3892-9-0x00007FFBB34C0000-0x00007FFBB34C2000-memory.dmp

    Filesize

    8KB

  • memory/3892-10-0x00007FFB8FBE0000-0x00007FFB9108B000-memory.dmp

    Filesize

    20.7MB

  • memory/3892-15-0x00007FFB8FCB7000-0x00007FFB90442000-memory.dmp

    Filesize

    7.5MB

  • memory/3892-16-0x00007FFB8FBE0000-0x00007FFB9108B000-memory.dmp

    Filesize

    20.7MB