Analysis
- user interaction
yes - max time kernel
150s - max time network
134s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
23/05/2026, 23:24
General
- Target GnfaRAT.exe
- Size 6.4MB
- Sample260523-3dp45afs8s
- SHA256 630ecc2e939173f60ad9f8be999c9a755bc42ba694514b990c499d4b221dd7aa
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\GnfaRAT.exe"C:\Users\Admin\AppData\Local\Temp\GnfaRAT.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\RepairRequest.vbs"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4680-0-0x00000197D1D40000-0x00000197D23B6000-memory.dmp
memory/4680-2-0x00000197ECC50000-0x00000197ECC60000-memory.dmp
memory/4680-3-0x00000197ECC60000-0x00000197ECEB2000-memory.dmp
memory/4680-4-0x00000197ECC50000-0x00000197ECC60000-memory.dmp
memory/4680-5-0x00000197ECC50000-0x00000197ECC60000-memory.dmp
memory/4680-6-0x00000197ECC50000-0x00000197ECC60000-memory.dmp