5732c8c276a56e3be14681104c173da854bcdf75affcc6ef5b50e5127e07e35c

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bundle/eon.exe
Size 23.0MB
Sample261024-xtfbzaby4w
SHA256 5732c8c276a56e3be14681104c173da854bcdf75affcc6ef5b50e5127e07e35c
MD5 1261b4f0888e4128f2b3bfebca4c5baa
SHA1 a259ae1fd90717599bd73d7807c355722a0211d6
SHA512 9808051c4471c53b56b0c1fe7467e62bb80791d7be204294c3ab2bed5b93eda899e8d497bb0c3a99d6e66e1dd3a628235d1f7994ebe353f75b7a8503171687d2
SSDEEP 393216:MYw7K3TDkGYrJtX6816vGwgLdYRAzFFAmmTFpAgeNcXRXS:MYKK3HkGkqESGzRYMYmmTFKkFS
TLSH
T1BC3712D5A8C446ECC792C635D28A16FEE2C5749A0FBA542F7FCA18023271C41D9E7E39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
4120	eon.exe
4120	eon.exe

C:\Users\Admin\AppData\Local\Temp\bundle\eon.exe
"C:\Users\Admin\AppData\Local\Temp\bundle\eon.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Debugger Evasion

T1622

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4120-0-0x00000001401C1000-0x000000014106E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads