3c00ee919b4e30197066e670cbd54ee8a9c9fad43d78e390307a60fad272acfd

Analysis

user interaction
yes
max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 12:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Zynova.exe
Size 28.5MB
Sample260930-ptpxeaycmd
SHA256 3c00ee919b4e30197066e670cbd54ee8a9c9fad43d78e390307a60fad272acfd
MD5 f1eadff53b0de21d7ce7395e84daf94f
SHA1 66dccb6f311aa47f598d6c8977d83aa7eec510bf
SHA512 a52d4dde989f2fafc5dd54c8963b8f8af65670d9f67c3082f7780e9982901679cbffa518daccb61b150d293f871579c2b7d5e392748fbf888dcf8ce6451f22f3
SSDEEP 393216:A2AdEXIWMqDhG0FLdj1mg3UN2Oa2NVH8p99pBW7ys1x+l6UB+ENhC3GLbkKd+/s1:PAr7q9GUjYgPiNVcp9J5rD0ELC3Y1+E
TLSH
T1F36723A675D6B2D887C30A48638E13DB50C1B57645F994343EC71803E920DEF7A8AEB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
6092	Zynova.exe
6092	Zynova.exe

C:\Users\Admin\AppData\Local\Temp\Zynova.exe
"C:\Users\Admin\AppData\Local\Temp\Zynova.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Debugger Evasion

T1622

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/6092-0-0x00007FF603F31000-0x00007FF604EC5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads