Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/08/2026, 04:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
- Size 12.6MB
- Sample260805-e1t5ladc94
- SHA256 c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023
- MD5 77f110a9f1e432ae6a85669ee6e04224
- SHA1 398ff0fae1cc7a1b99019c675ba0f42f9d8d333a
- SHA512 2f5261cea35e092f04079b9c04811da21320658417fceb4229baafb75bc65bdedaa0701d2cff38da31a93e5d53620b2fac37077fa7b039890e4976480e84b461
- SSDEEP 196608:aZCE+RSPD4vjbbcViPLpZ0BYPCqZJZ0NVpzwkpcVSkZD0J92GjLErija9v:aZrtBVur0KP30NEeRoO2WYv
- TLSH T1D5D622D465D4A37DC8818238F5455AEAF0D46C9E1DF9CA1AFF96C4327B70A48C8B1A33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 5424 c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe 5424 c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 5424 c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe 5424 c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe 5424 c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe 5424 c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe 5424 c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe 5424 c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe 5424 c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe 5424 c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe 5424 c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe 5424 c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe 5424 c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe 5424 c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe 5424 c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe 5424 c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe 5424 c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe 5424 c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe 5424 c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe 5424 c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe 5424 c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe 5424 c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe 5424 c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe 5424 c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe 5424 c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe 5424 c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5424 c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe"C:\Users\Admin\AppData\Local\Temp\c4fae09c1a12c7c7313a37d00d8a76cbf030d3a44cd76a62cee9c30c79fdc023 (2).exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:5424