Analysis
-
max time kernel
122s -
max time network
131s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
17-11-2021 16:43
General
-
Target
Ambrosial 1.16.221.exe
-
Size
23.5MB
-
MD5
991e3631ef2e4936f383a17bef591bd2
-
SHA1
952314c20eede07a7cf660c287830eaa2793317b
-
SHA256
8c260cc91749e30447e0f2782ece403724ba0e9624318e686b457e643842ed37
-
SHA512
9bc3c4ea0e4a8482034bcd740abf480f64412abfe02849e3b948c9b06027f7696834217f43cb2cd23e32a7138ae628ed44ca5187bc24233b6472b77bf7f452ef
Score
8/10
Malware Config
Signatures
-
VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
-
Drops file in Windows directory 3 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ambrosial 1.16.221.exe"C:\Users\Admin\AppData\Local\Temp\Ambrosial 1.16.221.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3360 -s 17482⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3360-115-0x0000027D6D150000-0x0000027D6D151000-memory.dmpFilesize
4KB
-
memory/3360-120-0x0000027D71370000-0x0000027D71371000-memory.dmpFilesize
4KB
-
memory/3360-119-0x0000027D713D0000-0x0000027D713D2000-memory.dmpFilesize
8KB
-
memory/3360-121-0x0000027D713A0000-0x0000027D713B6000-memory.dmpFilesize
88KB
-
memory/3360-122-0x0000027D71480000-0x0000027D71481000-memory.dmpFilesize
4KB
-
memory/3360-123-0x0000027D73310000-0x0000027D733BC000-memory.dmpFilesize
688KB