Analysis
- user interaction
yes - max time kernel
149s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
24/10/2026, 13:11
General
- Target Zero3.exe
- Size 4.6MB
- Sample261024-qe24vsfa46
- SHA256 0c46736d7091149d5ad610b87b5600975b3cc02da07c7aa60bfb3729fe29e26c
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Zero3.exe"C:\Users\Admin\AppData\Local\Temp\Zero3.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Zero3.exe"C:\Users\Admin\AppData\Local\Temp\Zero3.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3876-18-0x000001F5A0C00000-0x000001F5A0C74000-memory.dmp
memory/3876-21-0x000001F5A0C00000-0x000001F5A0C74000-memory.dmp
memory/3876-20-0x000001F5A0C00000-0x000001F5A0C74000-memory.dmp
memory/3876-19-0x000001F5A0C00000-0x000001F5A0C74000-memory.dmp
memory/3876-17-0x000001F5A0C00000-0x000001F5A0C74000-memory.dmp
memory/3876-16-0x000001F5A0C00000-0x000001F5A0C74000-memory.dmp
memory/3876-15-0x000001F5A0C00000-0x000001F5A0C74000-memory.dmp
memory/3876-13-0x000001F5A0C00000-0x000001F5A0C74000-memory.dmp
memory/3876-12-0x000001F5A0C00000-0x000001F5A0C74000-memory.dmp
memory/3876-11-0x000001F5A0C00000-0x000001F5A0C74000-memory.dmp
memory/3876-10-0x000001F5A0C00000-0x000001F5A0C74000-memory.dmp
memory/3876-9-0x000001F5A0C00000-0x000001F5A0C74000-memory.dmp
memory/3876-14-0x000001F5A0C00000-0x000001F5A0C74000-memory.dmp
memory/3876-8-0x000001F5A0C00000-0x000001F5A0C74000-memory.dmp
memory/3876-1-0x000001F5A0C00000-0x000001F5A0C74000-memory.dmp
memory/3876-0-0x000001F5A09C0000-0x000001F5A09D0000-memory.dmp
memory/4232-23-0x000001AFF8640000-0x000001AFF86B4000-memory.dmp
memory/4232-43-0x000001AFF8640000-0x000001AFF86B4000-memory.dmp
memory/4232-42-0x000001AFF8640000-0x000001AFF86B4000-memory.dmp
memory/4232-41-0x000001AFF8640000-0x000001AFF86B4000-memory.dmp
memory/4232-40-0x000001AFF8640000-0x000001AFF86B4000-memory.dmp
memory/4232-39-0x000001AFF8640000-0x000001AFF86B4000-memory.dmp
memory/4232-38-0x000001AFF8640000-0x000001AFF86B4000-memory.dmp
memory/4232-37-0x000001AFF8640000-0x000001AFF86B4000-memory.dmp
memory/4232-36-0x000001AFF8640000-0x000001AFF86B4000-memory.dmp
memory/4232-35-0x000001AFF8640000-0x000001AFF86B4000-memory.dmp
memory/4232-45-0x000001AFF8640000-0x000001AFF86B4000-memory.dmp
memory/4232-46-0x000001AFF8640000-0x000001AFF86B4000-memory.dmp
memory/4232-44-0x000001AFF8440000-0x000001AFF8441000-memory.dmp
memory/4232-34-0x000001AFF8640000-0x000001AFF86B4000-memory.dmp
memory/4232-33-0x000001AFF8640000-0x000001AFF86B4000-memory.dmp
memory/4232-32-0x000001AFF8640000-0x000001AFF86B4000-memory.dmp
memory/4232-47-0x000001AFF8640000-0x000001AFF86B4000-memory.dmp
memory/4232-31-0x000001AFF8640000-0x000001AFF86B4000-memory.dmp
memory/4232-30-0x000001AFF8640000-0x000001AFF86B4000-memory.dmp
memory/4232-22-0x000001AFF83E0000-0x000001AFF83F0000-memory.dmp
memory/4232-48-0x00007FF7FB840000-0x00007FF7FECED000-memory.dmp