Analysis
- max time kernel
150s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/08/2026, 07:48
Behavioral task
behavioral1
Sample
87a171e6a749340ffe3699524826cb1e52cad6e8f0e2350e84ced50dc13a8de8.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
87a171e6a749340ffe3699524826cb1e52cad6e8f0e2350e84ced50dc13a8de8.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 87a171e6a749340ffe3699524826cb1e52cad6e8f0e2350e84ced50dc13a8de8.exe
- Size 304KB
- Sample260811-jna86san21
- SHA256 87a171e6a749340ffe3699524826cb1e52cad6e8f0e2350e84ced50dc13a8de8
- MD5 14ca810daf0e2f39f91430a926ba057e
- SHA1 fb23cc15f29de6e9f3398d0430451c995c695d36
- SHA512 ce820a06e3c27fc24c332424c375ea74166a790d03eac7ecf2e7f1ac65f4017250761b92343b14b2b09f1a0968cdbfaa8a83b6201db535a854f4c2611bfa2d56
- SSDEEP 6144:b/nyRFP6OUs9LNkewS6D1zqfD4DSXG8PF56XmljojWq1OZNwp+0:b8FiOxFcDcr4V8PF7lsjEbwp
- TLSH T1006422C56224219FD99128B0CB0245937E9C75837CBAD6A2A3DFE2C4E9DC7C93E0152F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4596 87a171e6a749340ffe3699524826cb1e52cad6e8f0e2350e84ced50dc13a8de8.exe -
resource yara_rule behavioral2/memory/4596-0-0x00007FF641810000-0x00007FF641A02000-memory.dmp upx behavioral2/memory/4596-1-0x00007FF641810000-0x00007FF641A02000-memory.dmp upx - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4596 87a171e6a749340ffe3699524826cb1e52cad6e8f0e2350e84ced50dc13a8de8.exe 4596 87a171e6a749340ffe3699524826cb1e52cad6e8f0e2350e84ced50dc13a8de8.exe 4596 87a171e6a749340ffe3699524826cb1e52cad6e8f0e2350e84ced50dc13a8de8.exe 4596 87a171e6a749340ffe3699524826cb1e52cad6e8f0e2350e84ced50dc13a8de8.exe 4596 87a171e6a749340ffe3699524826cb1e52cad6e8f0e2350e84ced50dc13a8de8.exe 4596 87a171e6a749340ffe3699524826cb1e52cad6e8f0e2350e84ced50dc13a8de8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\87a171e6a749340ffe3699524826cb1e52cad6e8f0e2350e84ced50dc13a8de8.exe"C:\Users\Admin\AppData\Local\Temp\87a171e6a749340ffe3699524826cb1e52cad6e8f0e2350e84ced50dc13a8de8.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4596