e915c55dbb5ec35506d25685a0c1a841b257af3bb30745ec5be6019f9d6e5bb3

Resubmissions

04-05-2021 08:39

Target

DOC080221-08022021160011.bin.exe
Size

895KB
MD5

6fbb325e733601c4047943ab88e73044
SHA1

53fc02f829b6e2136b787d3a16d5ec69d58da7bf
SHA256

e915c55dbb5ec35506d25685a0c1a841b257af3bb30745ec5be6019f9d6e5bb3
SHA512

c1b06f871001004e9a91b27674f31a2b54d20830e3d29a31f644836d88347eb84d09ea2373ef62df1b04d72feb5501f15ce0521cefbad5021fdc6310ecfc905f

Score

7^/10

agilenet

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

Processes:

resource	yara_rule
behavioral1/memory/792-63-0x00000000006B0000-0x00000000006D1000-memory.dmp	agile_net

Suspicious use of SetThreadContext 1 IoCs

Processes:

DOC080221-08022021160011.bin.exe

description pid process target process

PID 792 set thread context of 1552 792 DOC080221-08022021160011.bin.exe DOC080221-08022021160011.bin.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

DOC080221-08022021160011.bin.exe

pid process

792 DOC080221-08022021160011.bin.exe
792 DOC080221-08022021160011.bin.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

DOC080221-08022021160011.bin.exe

description pid process

Token: SeDebugPrivilege 792 DOC080221-08022021160011.bin.exe

description	pid	process	target process
PID 792 set thread context of 1552	792	DOC080221-08022021160011.bin.exe	DOC080221-08022021160011.bin.exe

pid	process
792	DOC080221-08022021160011.bin.exe
792	DOC080221-08022021160011.bin.exe

description	pid	process
Token: SeDebugPrivilege	792	DOC080221-08022021160011.bin.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

DOC080221-08022021160011.bin.exe

description	pid	process	target process
PID 792 wrote to memory of 1552	792	DOC080221-08022021160011.bin.exe	DOC080221-08022021160011.bin.exe
PID 792 wrote to memory of 1552	792	DOC080221-08022021160011.bin.exe	DOC080221-08022021160011.bin.exe
PID 792 wrote to memory of 1552	792	DOC080221-08022021160011.bin.exe	DOC080221-08022021160011.bin.exe
PID 792 wrote to memory of 1552	792	DOC080221-08022021160011.bin.exe	DOC080221-08022021160011.bin.exe
PID 792 wrote to memory of 1552	792	DOC080221-08022021160011.bin.exe	DOC080221-08022021160011.bin.exe
PID 792 wrote to memory of 1552	792	DOC080221-08022021160011.bin.exe	DOC080221-08022021160011.bin.exe
PID 792 wrote to memory of 1552	792	DOC080221-08022021160011.bin.exe	DOC080221-08022021160011.bin.exe
PID 792 wrote to memory of 1552	792	DOC080221-08022021160011.bin.exe	DOC080221-08022021160011.bin.exe
PID 792 wrote to memory of 1552	792	DOC080221-08022021160011.bin.exe	DOC080221-08022021160011.bin.exe
PID 792 wrote to memory of 1552	792	DOC080221-08022021160011.bin.exe	DOC080221-08022021160011.bin.exe

C:\Users\Admin\AppData\Local\Temp\DOC080221-08022021160011.bin.exe
"C:\Users\Admin\AppData\Local\Temp\DOC080221-08022021160011.bin.exe"
2⤵
PID:1552

memory/792-59-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/792-61-0x00000000049F0000-0x00000000049F1000-memory.dmp

Filesize
4KB

Download
memory/792-63-0x00000000006B0000-0x00000000006D1000-memory.dmp

Filesize
132KB

Download
memory/792-64-0x0000000001F30000-0x0000000001F3B000-memory.dmp

Filesize
44KB

Download
memory/792-65-0x0000000001FA0000-0x0000000001FA1000-memory.dmp

Filesize
4KB

Download
memory/1552-67-0x000000000040CCEF-mapping.dmp

Download