a949023db784c4bbd82a2ce3d6957a457efb81dae684dd92bfd3b7fce3b8f679

Analysis

max time kernel
122s
max time network
139s
platform
windows7_x64
resource
win7-en-20211104
submitted
17-11-2021 16:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ambrosial 1.16.221.exe
Size

23.5MB
MD5

991e3631ef2e4936f383a17bef591bd2
SHA1

952314c20eede07a7cf660c287830eaa2793317b
SHA256

8c260cc91749e30447e0f2782ece403724ba0e9624318e686b457e643842ed37
SHA512

9bc3c4ea0e4a8482034bcd740abf480f64412abfe02849e3b948c9b06027f7696834217f43cb2cd23e32a7138ae628ed44ca5187bc24233b6472b77bf7f452ef

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral3/memory/1080-55-0x0000000000AC0000-0x0000000000AC1000-memory.dmp	vmprotect

Drops file in Windows directory 2 IoCs

Processes:

Ambrosial 1.16.221.exe

description	ioc	process
File created	C:\Windows\Fonts\Azonix.otf	Ambrosial 1.16.221.exe
File opened for modification	C:\Windows\Fonts\Azonix.otf	Ambrosial 1.16.221.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

360 1080 WerFault.exe Ambrosial 1.16.221.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

360 WerFault.exe
360 WerFault.exe
360 WerFault.exe
360 WerFault.exe
360 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

360 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 360 WerFault.exe

pid	pid_target	process	target process
360	1080	WerFault.exe	Ambrosial 1.16.221.exe

pid	process
360	WerFault.exe
360	WerFault.exe
360	WerFault.exe
360	WerFault.exe
360	WerFault.exe

pid	process
360	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	360	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Ambrosial 1.16.221.exe

description	pid	process	target process
PID 1080 wrote to memory of 360	1080	Ambrosial 1.16.221.exe	WerFault.exe
PID 1080 wrote to memory of 360	1080	Ambrosial 1.16.221.exe	WerFault.exe
PID 1080 wrote to memory of 360	1080	Ambrosial 1.16.221.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Ambrosial 1.16.221.exe
"C:\Users\Admin\AppData\Local\Temp\Ambrosial 1.16.221.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1080

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1080 -s 840
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:360

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/360-63-0x0000000000000000-mapping.dmp

Download
memory/360-64-0x000007FEFBE91000-0x000007FEFBE93000-memory.dmp

Filesize
8KB

Download
memory/360-65-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/1080-55-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

Filesize
4KB

Download
memory/1080-59-0x000000001EE50000-0x000000001EE52000-memory.dmp

Filesize
8KB

Download
memory/1080-60-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/1080-61-0x0000000000890000-0x00000000008A6000-memory.dmp

Filesize
88KB

Download
memory/1080-62-0x00000000008B0000-0x00000000008B1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads