Analysis
- max time kernel
144s - max time network
165s - platform
windows10-2004_x64 - resource
win10v2004-20250502-en - resource tags
- submitted
02/06/2025, 22:44
General
- Target uploaded/3ca0877ae8c3c628acfe78c6847f770fe20f02790f69749216cc703ab0618002.exe
- Size 1.4MB
- Sample250602-2pacdabk21
- SHA256 3ca0877ae8c3c628acfe78c6847f770fe20f02790f69749216cc703ab0618002
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\uploaded\3ca0877ae8c3c628acfe78c6847f770fe20f02790f69749216cc703ab0618002.exe"C:\Users\Admin\AppData\Local\Temp\uploaded\3ca0877ae8c3c628acfe78c6847f770fe20f02790f69749216cc703ab0618002.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1644-0-0x0000000002330000-0x0000000002371000-memory.dmp
memory/1644-1-0x000000007FC90000-0x000000007FC91000-memory.dmp
memory/1644-4-0x000000007FC90000-0x000000007FC91000-memory.dmp
memory/1644-14-0x000000007FC90000-0x000000007FC91000-memory.dmp
memory/1644-8-0x000000007FC90000-0x000000007FC91000-memory.dmp
memory/1644-6-0x000000007FC90000-0x000000007FC91000-memory.dmp
memory/1644-20-0x000000007FC90000-0x000000007FC91000-memory.dmp
memory/1644-28-0x000000007FC90000-0x000000007FC91000-memory.dmp
memory/1644-1455-0x0000000002330000-0x0000000002371000-memory.dmp