Analysis

  • geolocation tags

    nanew-jerseynorth-americaunited-statesususa
  • max time kernel
    65s
  • max time network
    35s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250619-en
  • resource tags

    arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    03/07/2025, 05:25

General

  • Target

    citra-setup-windows.exe

  • Size

    24.4MB

  • MD5

    4ef40ea49d688b1211ff3bde3e95c324

  • SHA1

    10a8feb1213d23b5215a2aaf30d190331394123f

  • SHA256

    a8aa0575929c2a6c7c7b54b776e2d61fa43b62c220fbce5cbc4a254b2d2ee522

  • SHA512

    03f4346d85054349fdc04b47b3ae280c736271a9c95967c1b2bf2b1a322afdc4740b201540078f0178fd2f22fa10cfcc7eda1acf2584bd822cb441d0f8f0d9ec

  • SSDEEP

    393216:CsV/CwiBSb0fjMQPqh4mA+Sf9JPAt4BQtPWiAhJfxa2+aegQkNFHtBJsv6tWKFdx:C2nhARkjk7Rt

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\citra-setup-windows.exe
    "C:\Users\Admin\AppData\Local\Temp\citra-setup-windows.exe"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:2500
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
    1⤵
      PID:3900

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2500-2-0x000001DA807B0000-0x000001DA807C0000-memory.dmp

            Filesize

            64KB

          • memory/2500-3-0x000001DA807C0000-0x000001DA809C0000-memory.dmp

            Filesize

            2.0MB

          • memory/2500-0-0x000001DA80FE0000-0x000001DA81420000-memory.dmp

            Filesize

            4.2MB