Analysis
- max time kernel
50s - max time network
150s - platform
windows10_x64 - resource
win10v20210408 - submitted
24/06/2021, 06:22
General
- Target 6aa97acca8545664077d24df70b2c5cd.exe
- Size 2.7MB
- Sample210624-5wp399cyss
- SHA256 c47a4294b97b5b05ac78f01950d4cf964faf03adf9f0b495c157d09c6f3cf564
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious use of SetThreadContext 1 IoCs
- autoit_exe 2 IoCs
AutoIT scripts compiled to PE executables.
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6aa97acca8545664077d24df70b2c5cd.exe"C:\Users\Admin\AppData\Local\Temp\6aa97acca8545664077d24df70b2c5cd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 708 -s 5803⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/396-119-0x0000000005870000-0x0000000005871000-memory.dmp
memory/396-125-0x0000000004DD0000-0x00000000052CE000-memory.dmp
memory/396-114-0x00000000002F0000-0x00000000002F1000-memory.dmp
memory/396-120-0x0000000004DD0000-0x00000000052CE000-memory.dmp
memory/396-122-0x0000000006600000-0x0000000006621000-memory.dmp
memory/396-123-0x00000000066D0000-0x00000000066D1000-memory.dmp
memory/396-124-0x00000000065C0000-0x00000000065C1000-memory.dmp
memory/396-118-0x0000000004F10000-0x0000000004F11000-memory.dmp
memory/396-126-0x0000000006AD0000-0x0000000006ADB000-memory.dmp
memory/396-127-0x0000000004840000-0x0000000004841000-memory.dmp
memory/396-117-0x0000000004E70000-0x0000000004E71000-memory.dmp
memory/396-116-0x00000000052D0000-0x00000000052D1000-memory.dmp
memory/708-134-0x0000000000410000-0x0000000000553000-memory.dmp