Resubmissions
26/02/2026, 13:24
260226-qng52sfs6h1025/02/2026, 13:07
260225-qc3ydafw2f1013/11/2025, 12:27
251113-pmta9azlhn1001/10/2025, 02:17
251001-cqt1qsxtav1025/09/2025, 14:55
250925-salx7azzhw10Analysis
- max time kernel
101s - max time network
105s - platform
windows11-21h2_x64 - resource
win11-20250619-en - resource tags
- submitted
01/10/2025, 02:17
General
- Target 51b9f246d6da85631131fcd1fabf0a67937d4bdde33625a44f7ee6a3a7baebd2.exe
- Size 14.2MB
- Sample251001-cqt1qsxtav
- SHA256 51b9f246d6da85631131fcd1fabf0a67937d4bdde33625a44f7ee6a3a7baebd2
Score
10/10
Malware Config
Signatures
- Detects Gentlemen ransomware 2 IoCs
- Gentlemen
Gentlemen is a ransomware written in Golang.
- Gentlemen family
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\51b9f246d6da85631131fcd1fabf0a67937d4bdde33625a44f7ee6a3a7baebd2.exe"C:\Users\Admin\AppData\Local\Temp\51b9f246d6da85631131fcd1fabf0a67937d4bdde33625a44f7ee6a3a7baebd2.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/968-0-0x000000000078A000-0x0000000000F66000-memory.dmp
memory/968-2-0x00007FFE48380000-0x00007FFE48382000-memory.dmp
memory/968-1-0x00007FFE48370000-0x00007FFE48372000-memory.dmp
memory/968-7-0x00000000004D0000-0x0000000001DA0000-memory.dmp
memory/968-9-0x000000000078A000-0x0000000000F66000-memory.dmp
memory/968-10-0x00000000004D0000-0x0000000001DA0000-memory.dmp