e915c55dbb5ec35506d25685a0c1a841b257af3bb30745ec5be6019f9d6e5bb3

General

Target

6fbb325e_by_Libranalysis.exe
Size

895KB
MD5

6fbb325e733601c4047943ab88e73044
SHA1

53fc02f829b6e2136b787d3a16d5ec69d58da7bf
SHA256

e915c55dbb5ec35506d25685a0c1a841b257af3bb30745ec5be6019f9d6e5bb3
SHA512

c1b06f871001004e9a91b27674f31a2b54d20830e3d29a31f644836d88347eb84d09ea2373ef62df1b04d72feb5501f15ce0521cefbad5021fdc6310ecfc905f

Score

7^/10

agilenet

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

Processes:

resource	yara_rule
behavioral1/memory/1820-64-0x0000000000590000-0x00000000005B1000-memory.dmp	agile_net

Suspicious use of SetThreadContext 1 IoCs

Processes:

6fbb325e_by_Libranalysis.exe

description pid process target process

PID 1820 set thread context of 1476 1820 6fbb325e_by_Libranalysis.exe 6fbb325e_by_Libranalysis.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

6fbb325e_by_Libranalysis.exe6fbb325e_by_Libranalysis.exe

pid process

1820 6fbb325e_by_Libranalysis.exe
1820 6fbb325e_by_Libranalysis.exe
1476 6fbb325e_by_Libranalysis.exe
1476 6fbb325e_by_Libranalysis.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

6fbb325e_by_Libranalysis.exe6fbb325e_by_Libranalysis.exe

description pid process

Token: SeDebugPrivilege 1820 6fbb325e_by_Libranalysis.exe
Token: SeDebugPrivilege 1476 6fbb325e_by_Libranalysis.exe

description	pid	process	target process
PID 1820 set thread context of 1476	1820	6fbb325e_by_Libranalysis.exe	6fbb325e_by_Libranalysis.exe

description	pid	process
Token: SeDebugPrivilege	1820	6fbb325e_by_Libranalysis.exe
Token: SeDebugPrivilege	1476	6fbb325e_by_Libranalysis.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

6fbb325e_by_Libranalysis.exe

description	pid	process	target process
PID 1820 wrote to memory of 1476	1820	6fbb325e_by_Libranalysis.exe	6fbb325e_by_Libranalysis.exe
PID 1820 wrote to memory of 1476	1820	6fbb325e_by_Libranalysis.exe	6fbb325e_by_Libranalysis.exe
PID 1820 wrote to memory of 1476	1820	6fbb325e_by_Libranalysis.exe	6fbb325e_by_Libranalysis.exe
PID 1820 wrote to memory of 1476	1820	6fbb325e_by_Libranalysis.exe	6fbb325e_by_Libranalysis.exe
PID 1820 wrote to memory of 1476	1820	6fbb325e_by_Libranalysis.exe	6fbb325e_by_Libranalysis.exe
PID 1820 wrote to memory of 1476	1820	6fbb325e_by_Libranalysis.exe	6fbb325e_by_Libranalysis.exe
PID 1820 wrote to memory of 1476	1820	6fbb325e_by_Libranalysis.exe	6fbb325e_by_Libranalysis.exe
PID 1820 wrote to memory of 1476	1820	6fbb325e_by_Libranalysis.exe	6fbb325e_by_Libranalysis.exe
PID 1820 wrote to memory of 1476	1820	6fbb325e_by_Libranalysis.exe	6fbb325e_by_Libranalysis.exe
PID 1820 wrote to memory of 1476	1820	6fbb325e_by_Libranalysis.exe	6fbb325e_by_Libranalysis.exe

memory/1476-74-0x0000000000DE2000-0x0000000000DE4000-memory.dmp

Filesize
8KB

Download
memory/1476-68-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1476-77-0x0000000000DE9000-0x0000000000DEA000-memory.dmp

Filesize
4KB

Download
memory/1476-76-0x00000000009E0000-0x00000000009E1000-memory.dmp

Filesize
4KB

Download
memory/1476-70-0x0000000076641000-0x0000000076643000-memory.dmp

Filesize
8KB

Download
memory/1476-75-0x0000000000DE7000-0x0000000000DE9000-memory.dmp

Filesize
8KB

Download
memory/1476-73-0x0000000000DE1000-0x0000000000DE2000-memory.dmp

Filesize
4KB

Download
memory/1476-69-0x000000000040CCEF-mapping.dmp

Download
memory/1476-71-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1476-72-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Filesize
4KB

Download
memory/1820-66-0x0000000000680000-0x000000000068B000-memory.dmp

Filesize
44KB

Download
memory/1820-62-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

Filesize
4KB

Download
memory/1820-60-0x0000000001170000-0x0000000001171000-memory.dmp

Filesize
4KB

Download
memory/1820-67-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

Filesize
4KB

Download
memory/1820-65-0x0000000004BC1000-0x0000000004BC2000-memory.dmp

Filesize
4KB

Download
memory/1820-64-0x0000000000590000-0x00000000005B1000-memory.dmp

Filesize
132KB

Download