2c69c96d9a123e6b5fc3d2c940bb268faf6cfbed823b137d80a04ff7e361541c | Triage

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7v20210410
submitted
15-04-2021 03:30

Sharing

Report Analysis Logs

General

Target

SKM_DD3350191107102300.exe
Size

457KB
MD5

a5e9d51ec0c2752e94ccbbf452100a5e
SHA1

548a7e639da0966d1ecd1d4b92e6e527e8b62f53
SHA256

891963a81a44a4539492b1c7aaa3c0ff69a758ecafa6968cd242dc62982cc446
SHA512

8da6df239103cd6fcaea505e8a97eeb9ecf3338878513dbaa195bd82c82853f5d5aa5e599e43162e4f3d2429c3ab8610526595a8e35eb13ec1f2a3f5e0e5e74a

Score

7^/10

agilenet

Malware Config

Signatures

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

Processes:

resource	yara_rule
behavioral1/memory/1688-64-0x0000000000670000-0x0000000000691000-memory.dmp	agile_net

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

SKM_DD3350191107102300.exe

pid process

1688 SKM_DD3350191107102300.exe
1688 SKM_DD3350191107102300.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

SKM_DD3350191107102300.exe

description pid process

Token: SeDebugPrivilege 1688 SKM_DD3350191107102300.exe

C:\Users\Admin\AppData\Local\Temp\SKM_DD3350191107102300.exe
"C:\Users\Admin\AppData\Local\Temp\SKM_DD3350191107102300.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1688-60-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/1688-62-0x0000000004560000-0x0000000004561000-memory.dmp

Filesize
4KB

Download
memory/1688-64-0x0000000000670000-0x0000000000691000-memory.dmp

Filesize
132KB

Download
memory/1688-65-0x0000000004561000-0x0000000004562000-memory.dmp

Filesize
4KB

Download