Analysis
-
max time kernel
17s -
max time network
21s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-10-2024 19:28
General
-
Target
auth.exe
-
Size
7.4MB
-
MD5
1ac65b4ef2240f786c7044114b4b50ca
-
SHA1
62f9c473298583331059a9520cd8c15dc5dcbf79
-
SHA256
98ea51a36daf5312cbb1b1df3ef9e2e613c9cb8bc3a208154b2a1467c64d5679
-
SHA512
546337e53d1a6734048f68b895de88e2b7a7cf62642d3447d688dafdce4d72520a0d73e7c3391d14df15597f3352608930a71019e9c40a1252046dcf3fcd310f
-
SSDEEP
196608:eVYKheGSdSHfH+5LMssz8WgnfWLjxf99GJ5g/:ah7qSHfH+5LMcFkj599w5W
Score
6/10
Malware Config
Signatures
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\auth.exe"C:\Users\Admin\AppData\Local\Temp\auth.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18.6MB
-
Filesize
1.7MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
18.6MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
18.6MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
18.6MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
18.6MB