Resubmissions
04-05-2021 08:39
210504-k6qtx4qgpx 7Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
04-05-2021 08:39
Static task
static1
Behavioral task
behavioral1
Sample
DOC080221-08022021160011.bin.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
DOC080221-08022021160011.bin.exe
Resource
win10v20210408
General
-
Target
DOC080221-08022021160011.bin.exe
-
Size
895KB
-
MD5
6fbb325e733601c4047943ab88e73044
-
SHA1
53fc02f829b6e2136b787d3a16d5ec69d58da7bf
-
SHA256
e915c55dbb5ec35506d25685a0c1a841b257af3bb30745ec5be6019f9d6e5bb3
-
SHA512
c1b06f871001004e9a91b27674f31a2b54d20830e3d29a31f644836d88347eb84d09ea2373ef62df1b04d72feb5501f15ce0521cefbad5021fdc6310ecfc905f
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/800-122-0x00000000068F0000-0x0000000006911000-memory.dmp agile_net -
Suspicious use of SetThreadContext 1 IoCs
Processes:
DOC080221-08022021160011.bin.exedescription pid process target process PID 800 set thread context of 2236 800 DOC080221-08022021160011.bin.exe DOC080221-08022021160011.bin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
DOC080221-08022021160011.bin.exepid process 800 DOC080221-08022021160011.bin.exe 800 DOC080221-08022021160011.bin.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
DOC080221-08022021160011.bin.exedescription pid process Token: SeDebugPrivilege 800 DOC080221-08022021160011.bin.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
DOC080221-08022021160011.bin.exedescription pid process target process PID 800 wrote to memory of 2236 800 DOC080221-08022021160011.bin.exe DOC080221-08022021160011.bin.exe PID 800 wrote to memory of 2236 800 DOC080221-08022021160011.bin.exe DOC080221-08022021160011.bin.exe PID 800 wrote to memory of 2236 800 DOC080221-08022021160011.bin.exe DOC080221-08022021160011.bin.exe PID 800 wrote to memory of 2236 800 DOC080221-08022021160011.bin.exe DOC080221-08022021160011.bin.exe PID 800 wrote to memory of 2236 800 DOC080221-08022021160011.bin.exe DOC080221-08022021160011.bin.exe PID 800 wrote to memory of 2236 800 DOC080221-08022021160011.bin.exe DOC080221-08022021160011.bin.exe PID 800 wrote to memory of 2236 800 DOC080221-08022021160011.bin.exe DOC080221-08022021160011.bin.exe PID 800 wrote to memory of 2236 800 DOC080221-08022021160011.bin.exe DOC080221-08022021160011.bin.exe PID 800 wrote to memory of 2236 800 DOC080221-08022021160011.bin.exe DOC080221-08022021160011.bin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DOC080221-08022021160011.bin.exe"C:\Users\Admin\AppData\Local\Temp\DOC080221-08022021160011.bin.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DOC080221-08022021160011.bin.exe"C:\Users\Admin\AppData\Local\Temp\DOC080221-08022021160011.bin.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/800-114-0x00000000006B0000-0x00000000006B1000-memory.dmpFilesize
4KB
-
memory/800-116-0x0000000005540000-0x0000000005541000-memory.dmpFilesize
4KB
-
memory/800-117-0x0000000005120000-0x0000000005121000-memory.dmpFilesize
4KB
-
memory/800-118-0x00000000051C0000-0x00000000051C1000-memory.dmpFilesize
4KB
-
memory/800-119-0x0000000005B60000-0x0000000005B61000-memory.dmpFilesize
4KB
-
memory/800-120-0x0000000005B50000-0x0000000005B51000-memory.dmpFilesize
4KB
-
memory/800-122-0x00000000068F0000-0x0000000006911000-memory.dmpFilesize
132KB
-
memory/800-123-0x00000000069C0000-0x00000000069C1000-memory.dmpFilesize
4KB
-
memory/800-124-0x00000000068B0000-0x00000000068B1000-memory.dmpFilesize
4KB
-
memory/800-125-0x0000000005B51000-0x0000000005B52000-memory.dmpFilesize
4KB
-
memory/800-126-0x0000000007260000-0x000000000726B000-memory.dmpFilesize
44KB
-
memory/800-127-0x0000000009870000-0x0000000009871000-memory.dmpFilesize
4KB
-
memory/2236-129-0x000000000040CCEF-mapping.dmp