a9f6ef13af75a45e21a84953e3ad505fc5f5bcd0d126ed5f8cb2bbccc5e698c1

General

Target

7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exe
Size

1.4MB
MD5

2cb8100f3ebd38a989dc97a960b86aa4
SHA1

7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c
SHA256

1969a9dbc990ec8d4c4c9b8133a7a7ec4651f2e5af0bc1da9e6973a22f34aad3
SHA512

2bde24565262adf6a990d09dd5d25acc4fcefb94d65cfd05d49dcf6f8daf2b7ec784cb55b0f146887e52d2c3121c2f97f01571de2cbf3a675fca9b745e168a0c

Score

10^/10

agilenet

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 1284 created 3416 1284 WerFault.exe 7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exe

description	pid	process	target process
PID 1284 created 3416	1284	WerFault.exe	7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exe

Obfuscated with Agile.Net obfuscator 2 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral2/memory/4060-123-0x0000000007990000-0x00000000079B1000-memory.dmp	agile_net
behavioral2/memory/4060-126-0x0000000004D90000-0x000000000528E000-memory.dmp	agile_net

Suspicious use of SetThreadContext 1 IoCs

Processes:

7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exe

description	pid	process	target process
PID 4060 set thread context of 3416	4060	7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exe	7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1284 3416 WerFault.exe 7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exe

pid	pid_target	process	target process
1284	3416	WerFault.exe	7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exeWerFault.exe

pid	process
4060	7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exe
4060	7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exe
1284	WerFault.exe
1284	WerFault.exe
1284	WerFault.exe
1284	WerFault.exe
1284	WerFault.exe
1284	WerFault.exe
1284	WerFault.exe
1284	WerFault.exe
1284	WerFault.exe
1284	WerFault.exe
1284	WerFault.exe
1284	WerFault.exe
1284	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	4060	7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exe
Token: SeRestorePrivilege	1284	WerFault.exe
Token: SeBackupPrivilege	1284	WerFault.exe
Token: SeDebugPrivilege	1284	WerFault.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exe

description	pid	process	target process
PID 4060 wrote to memory of 3416	4060	7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exe	7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exe
PID 4060 wrote to memory of 3416	4060	7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exe	7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exe
PID 4060 wrote to memory of 3416	4060	7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exe	7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exe
PID 4060 wrote to memory of 3416	4060	7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exe	7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exe
PID 4060 wrote to memory of 3416	4060	7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exe	7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exe
PID 4060 wrote to memory of 3416	4060	7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exe	7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exe
PID 4060 wrote to memory of 3416	4060	7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exe	7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exe
PID 4060 wrote to memory of 3416	4060	7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exe	7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exe
PID 4060 wrote to memory of 3416	4060	7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exe	7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exe

C:\Users\Admin\AppData\Local\Temp\7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exe
"C:\Users\Admin\AppData\Local\Temp\7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4060

C:\Users\Admin\AppData\Local\Temp\7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exe
"C:\Users\Admin\AppData\Local\Temp\7ddf1c0004d5cb08afdb7a4ad2198232c584ee7c.exe"
2⤵
PID:3416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 764
3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3416-129-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/3416-131-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/3416-130-0x000000000043E628-mapping.dmp

Download
memory/4060-124-0x0000000007A40000-0x0000000007A41000-memory.dmp

Filesize
4KB

Download
memory/4060-119-0x0000000005790000-0x0000000005791000-memory.dmp

Filesize
4KB

Download
memory/4060-120-0x0000000004E90000-0x0000000004E91000-memory.dmp

Filesize
4KB

Download
memory/4060-121-0x0000000004D90000-0x000000000528E000-memory.dmp

Filesize
5.0MB

Download
memory/4060-123-0x0000000007990000-0x00000000079B1000-memory.dmp

Filesize
132KB

Download
memory/4060-114-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/4060-125-0x0000000007940000-0x0000000007941000-memory.dmp

Filesize
4KB

Download
memory/4060-126-0x0000000004D90000-0x000000000528E000-memory.dmp

Filesize
5.0MB

Download
memory/4060-127-0x0000000006570000-0x000000000657B000-memory.dmp

Filesize
44KB

Download
memory/4060-128-0x00000000070E0000-0x00000000070E1000-memory.dmp

Filesize
4KB

Download
memory/4060-118-0x0000000004F40000-0x0000000004F41000-memory.dmp

Filesize
4KB

Download
memory/4060-117-0x0000000004C90000-0x0000000004C91000-memory.dmp

Filesize
4KB

Download
memory/4060-116-0x0000000005290000-0x0000000005291000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads