Analysis
-
max time kernel
91s -
max time network
151s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
-
submitted
02/12/2024, 16:10
General
-
Target
tmpfile-main/Hybris_DragonSafe.exe
-
Size
5.2MB
-
MD5
62d9c2c02adf5c6d0fa9652c9e393a6c
-
SHA1
c52f6dc02253b89e27f4ab5cdca547a03fd3d174
-
SHA256
e0c9b189665db1472fdd883c9cdea327514e05143ddb2db54ef5aaa52a6c8ca4
-
SHA512
108d73086df770be5721a4d3ff2922e0251e22c685c6914b60a6124da28019a92ff0868861076e9b80d231c6f2a79cdbb9e8fe064fd8d248782b7d4d3ae57feb
-
SSDEEP
98304:Deox05aqx/R+IelPauk5/cJADgYKsRr4dk9nUNMfR+JMgMV2:uN9R1e87HHZFnUN66
Score
7/10
Malware Config
Signatures
-
VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmpfile-main\Hybris_DragonSafe.exe"C:\Users\Admin\AppData\Local\Temp\tmpfile-main\Hybris_DragonSafe.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8.7MB
-
Filesize
3.4MB
-
Filesize
8.7MB