Analysis
- user interaction
yes - max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 13:11
General
- Target Zero3.exe
- Size 4.6MB
- Sample261024-qe24vsfa46
- SHA256 0c46736d7091149d5ad610b87b5600975b3cc02da07c7aa60bfb3729fe29e26c
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 5 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Zero3.exe"C:\Users\Admin\AppData\Local\Temp\Zero3.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Zero3.exe"C:\Users\Admin\AppData\Local\Temp\Zero3.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2600-18-0x0000019376980000-0x00000193769F4000-memory.dmp
memory/2600-19-0x0000019376980000-0x00000193769F4000-memory.dmp
memory/2600-16-0x0000019376980000-0x00000193769F4000-memory.dmp
memory/2600-12-0x0000019376980000-0x00000193769F4000-memory.dmp
memory/2600-8-0x0000019376980000-0x00000193769F4000-memory.dmp
memory/2600-11-0x0000019376980000-0x00000193769F4000-memory.dmp
memory/2600-17-0x0000019376980000-0x00000193769F4000-memory.dmp
memory/2600-0-0x0000019376A00000-0x0000019376A10000-memory.dmp
memory/2600-20-0x0000019376980000-0x00000193769F4000-memory.dmp
memory/2600-21-0x0000019376980000-0x00000193769F4000-memory.dmp
memory/2600-1-0x0000019376980000-0x00000193769F4000-memory.dmp
memory/2600-9-0x0000019376980000-0x00000193769F4000-memory.dmp
memory/2600-10-0x0000019376980000-0x00000193769F4000-memory.dmp
memory/2600-13-0x0000019376980000-0x00000193769F4000-memory.dmp
memory/2600-14-0x0000019376980000-0x00000193769F4000-memory.dmp
memory/2600-15-0x0000019376980000-0x00000193769F4000-memory.dmp
memory/3944-46-0x00000259DC150000-0x00000259DC1C4000-memory.dmp
memory/3944-38-0x00000259DC150000-0x00000259DC1C4000-memory.dmp
memory/3944-36-0x00000259DC150000-0x00000259DC1C4000-memory.dmp
memory/3944-35-0x00000259DC150000-0x00000259DC1C4000-memory.dmp
memory/3944-34-0x00000259DC150000-0x00000259DC1C4000-memory.dmp
memory/3944-33-0x00000259DC150000-0x00000259DC1C4000-memory.dmp
memory/3944-32-0x00000259DC150000-0x00000259DC1C4000-memory.dmp
memory/3944-31-0x00000259DC150000-0x00000259DC1C4000-memory.dmp
memory/3944-30-0x00000259DC150000-0x00000259DC1C4000-memory.dmp
memory/3944-23-0x00000259DC150000-0x00000259DC1C4000-memory.dmp
memory/3944-22-0x00000259DC1D0000-0x00000259DC1E0000-memory.dmp
memory/3944-37-0x00000259DC150000-0x00000259DC1C4000-memory.dmp
memory/3944-39-0x00000259DC150000-0x00000259DC1C4000-memory.dmp
memory/3944-40-0x00000259DC150000-0x00000259DC1C4000-memory.dmp
memory/3944-41-0x00000259DC150000-0x00000259DC1C4000-memory.dmp
memory/3944-44-0x00000259DC1F0000-0x00000259DC1F1000-memory.dmp
memory/3944-45-0x00000259DC150000-0x00000259DC1C4000-memory.dmp
memory/3944-47-0x00000259DC150000-0x00000259DC1C4000-memory.dmp
memory/3944-42-0x00000259DC150000-0x00000259DC1C4000-memory.dmp
memory/3944-43-0x00000259DC150000-0x00000259DC1C4000-memory.dmp
memory/3944-48-0x00007FF64BA60000-0x00007FF64EF0D000-memory.dmp
memory/3944-50-0x00000259DC150000-0x00000259DC1C4000-memory.dmp
memory/3944-51-0x00000259DC150000-0x00000259DC1C4000-memory.dmp