Analysis
-
max time kernel
167s -
max time network
145s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
17-11-2021 16:43
General
-
Target
Ambrosial.exe
-
Size
15.9MB
-
MD5
e3635a875aa0817f0e29544ad9ff84b5
-
SHA1
fd65adfd5be0391790442dc1b4d21b7ee4be271a
-
SHA256
b9c94c4a6dca1b5a42b05e4814838a9281768ba9267803a554c23b68c0665b0f
-
SHA512
132ee0718115097a6b9afc2368bf652d8b04207a6822a9a9e1900bc2921d3b8de384a40eec326e1662bfd7216b29cbe85ceeb8a7d49fe8ed293c4360b8115f0a
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Drops file in Windows directory 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe"C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
9c43f77cb7cff27cb47ed67babe3eda5
SHA1b0400cf68249369d21de86bd26bb84ccffd47c43
SHA256f25b9288fe370dcfcb4823fb4e44ab88c7f5fce6e137d0dba389a3dba07d621e
SHA512cde6fb6cf8db6f9746e69e6c10214e60b3646700d70b49668a2a792e309714dd2d4c5a5241977a833a95fcde8318abcc89eb9968a5039a0b75726bbfa27125a7
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
88KB
-
Filesize
4KB
-
Filesize
688KB
-
Filesize
4KB
-
Filesize
1.9MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
4KB