3c9f41ec2d1f65f66eaebea80acfbcad2d5adfd2df2d73bb42acf46fb0a120d2

Analysis

max time kernel
40s
max time network
26s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 16:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Neverlose.exe
Size 39.6MB
Sample261017-tfstcssw8q
SHA256 3c9f41ec2d1f65f66eaebea80acfbcad2d5adfd2df2d73bb42acf46fb0a120d2
MD5 5b93f9b0e9eaf80ab98cc0195b551c42
SHA1 7018f4add3aa21a864ecb0933e45a3dee2849c26
SHA512 4e60e1c723758fa55222c65bf4178694fda314e5ce9d5ad9cefc92d198c313289b582f771c897d76411e4dc051f7cab85ff1a540ed61b5ded5ac890f7db481a4
SSDEEP 786432:jEyGJw2XqLmxhhIBSaFRIRxxdV2nmPaCJqCMMMMMeEEEEpSS:jEyGJ3sIRxx/2mPaCJ/SS
TLSH
T19097AD2171828EADCA31AB7494B37F13F6A1F0DD92B61AB35371859E8DC87DC80507B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
1928	Neverlose.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1928	Neverlose.exe
1928	Neverlose.exe

C:\Users\Admin\AppData\Local\Temp\Neverlose.exe
"C:\Users\Admin\AppData\Local\Temp\Neverlose.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Debugger Evasion

T1622

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads