c8081f6858328c3302a2ddfcee8e1f3e9a2fc33eb54d702e691f8d56f50614f6

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 17:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1zrrNrl0.exe
Size 25.3MB
Sample261018-wc44bsca39
SHA256 c8081f6858328c3302a2ddfcee8e1f3e9a2fc33eb54d702e691f8d56f50614f6
MD5 cfddb0c53979468fe6a8c854ce12785b
SHA1 784c38ce560ae17a4f8257020b3dacd2dd3eb012
SHA512 f97c3f7f4c378c9228f5b7de6b7133f5dcff87388b242ff6b1f3b3211d584b6cefd95b3fed1dd13c28f321ddedab486ed2ab2f7abda81afb5795013b250f74da
SSDEEP 786432:PzGeyatF5XF2ad/cfHgMyi78URXoQVnC:Hya/5XFXd0PgzZCoGC
TLSH
T19C47129578D082ECCB92C930E2491AFDF0D9359A0EBA592F7FCA09013631D56CDE6E35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
2240	1zrrNrl0.exe
2240	1zrrNrl0.exe

C:\Users\Admin\AppData\Local\Temp\1zrrNrl0.exe
"C:\Users\Admin\AppData\Local\Temp\1zrrNrl0.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Debugger Evasion

T1622

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2240-0-0x00000001401C7000-0x00000001411DE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads