39164f1392b16c4e3d22e2bd9f7bedaa80f4bf5b9ff1b506e0a78f7da05419fc | Triage

Analysis

max time kernel
16s
max time network
15s
platform
windows7_x64
resource
win7v20210408
submitted
13-04-2021 16:05

Sharing

Report Analysis Logs

General

Target

Quotation AE2101137.exe
Size

625KB
MD5

75fb4c6ac75bd462bc69ac759d151c16
SHA1

dc63c2943403dd9e3d2fe95c0b5e906d8257dce4
SHA256

39164f1392b16c4e3d22e2bd9f7bedaa80f4bf5b9ff1b506e0a78f7da05419fc
SHA512

d7246709c1af0cde2355a81dcd527a7b4c6d2376c497c5e2cfc5dff90b0b9c66196671c6e0f5f4ca9b7cd9fda017336344533fe65a1ab52cc6d5f51b7139af59

Score

7^/10

agilenet

Malware Config

Signatures

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

Processes:

resource	yara_rule
behavioral1/memory/1776-64-0x00000000047E0000-0x0000000004801000-memory.dmp	agile_net

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Quotation AE2101137.exe

pid process

1776 Quotation AE2101137.exe
1776 Quotation AE2101137.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Quotation AE2101137.exe

description pid process

Token: SeDebugPrivilege 1776 Quotation AE2101137.exe

C:\Users\Admin\AppData\Local\Temp\Quotation AE2101137.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation AE2101137.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1776-60-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download
memory/1776-62-0x0000000004810000-0x0000000004811000-memory.dmp

Filesize
4KB

Download
memory/1776-64-0x00000000047E0000-0x0000000004801000-memory.dmp

Filesize
132KB

Download
memory/1776-65-0x0000000004811000-0x0000000004812000-memory.dmp

Filesize
4KB

Download