Overview

overview

5

Static

static

3

thraxv2.exe

windows10-2004-x64

5

Analysis

  • max time kernel
    13s
  • max time network
    15s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/10/2024, 03:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    thraxv2.exe

  • Size

    61.5MB

  • MD5

    c6bac78c48eca5a70a14c364a86b35a9

  • SHA1

    4a54ffa706106ce5d597a5e7bb0483932d414883

  • SHA256

    debcacd7f9ba39c12d1caf2828bfb09ef121c2a1257fa0b75a2770256e3b4490

  • SHA512

    b9ca005b38fc6123d1492bd4d15473810876ae003252a60397d59c81785df07a32c99e45288e547f426e2e1147bcf83764473f05dec8b6d19996aa076334e931

  • SSDEEP

    1572864:Omy2ObAVSbUrxZs6fbu593wCqtQ6uW1xHuN:OmFbrw6fb49JbW

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\thraxv2.exe
    "C:\Users\Admin\AppData\Local\Temp\thraxv2.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2708
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\thraxv2.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4396
      • C:\Windows\system32\certutil.exe
        certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\thraxv2.exe" MD5
        3⤵
          PID:3316
        • C:\Windows\system32\find.exe
          find /i /v "md5"
          3⤵
            PID:676
          • C:\Windows\system32\find.exe
            find /i /v "certutil"
            3⤵
              PID:1444

        Network

              MITRE ATT&CK Matrix

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/2708-0-0x0000000140187000-0x0000000142DC7000-memory.dmp

                Filesize

                44.2MB

                Download

              • memory/2708-2-0x00007FFF64360000-0x00007FFF64362000-memory.dmp

                Filesize

                8KB

                Download

              • memory/2708-1-0x00007FFF64350000-0x00007FFF64352000-memory.dmp

                Filesize

                8KB

                Download

              • memory/2708-3-0x0000000140000000-0x0000000141000000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/2708-7-0x0000000140187000-0x0000000142DC7000-memory.dmp

                Filesize

                44.2MB

                Download