Analysis
-
max time kernel
16s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
13-04-2021 16:05
General
-
Target
Quotation AE2101137.exe
-
Size
625KB
-
MD5
75fb4c6ac75bd462bc69ac759d151c16
-
SHA1
dc63c2943403dd9e3d2fe95c0b5e906d8257dce4
-
SHA256
39164f1392b16c4e3d22e2bd9f7bedaa80f4bf5b9ff1b506e0a78f7da05419fc
-
SHA512
d7246709c1af0cde2355a81dcd527a7b4c6d2376c497c5e2cfc5dff90b0b9c66196671c6e0f5f4ca9b7cd9fda017336344533fe65a1ab52cc6d5f51b7139af59
Score
7/10
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quotation AE2101137.exe"C:\Users\Admin\AppData\Local\Temp\Quotation AE2101137.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3944-114-0x0000000000D40000-0x0000000000D41000-memory.dmpFilesize
4KB
-
memory/3944-116-0x00000000055E0000-0x00000000055E1000-memory.dmpFilesize
4KB
-
memory/3944-117-0x0000000005B80000-0x0000000005B81000-memory.dmpFilesize
4KB
-
memory/3944-118-0x0000000005720000-0x0000000005721000-memory.dmpFilesize
4KB
-
memory/3944-119-0x00000000057C0000-0x00000000057C1000-memory.dmpFilesize
4KB
-
memory/3944-120-0x00000000061F0000-0x00000000061F1000-memory.dmpFilesize
4KB
-
memory/3944-122-0x0000000006F10000-0x0000000006F31000-memory.dmpFilesize
132KB
-
memory/3944-123-0x0000000006FD0000-0x0000000006FD1000-memory.dmpFilesize
4KB
-
memory/3944-124-0x0000000006EE0000-0x0000000006EE1000-memory.dmpFilesize
4KB
-
memory/3944-125-0x00000000061F1000-0x00000000061F2000-memory.dmpFilesize
4KB