7bb432c0ac0cf65de6c795685a41b1478f9d979e2b05bd9c8fb11725f9942e01

Analysis

max time kernel
51s
max time network
169s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
10-08-2022 11:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7.0.0.0.exe
Size

6.4MB
MD5

514ca6348b6d29069d6b436fc1f1c159
SHA1

ebd3d2d7924b78a165eb2d689eae5ff90c709e01
SHA256

35b846afc6bf51292d8a401a68a24a0e36d131d7798ceaa8713f08b6942fe0b5
SHA512

e51f635718f021f5f238b2510c8e7b99b57318cbcbae09773ea123c275f48156f6ca76be6aaea7901a6d7351d54aa8486dbcd01160a18082c59fb09211ab533e

Score

7^/10

agilenet

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

7.0.0.0.exe

pid process

1224 7.0.0.0.exe

pid	process
1224	7.0.0.0.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/1224-57-0x0000000008FB0000-0x00000000091FC000-memory.dmp	agile_net

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

7.0.0.0.exe

description pid process

Token: SeDebugPrivilege 1224 7.0.0.0.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

7.0.0.0.exe

pid process

1224 7.0.0.0.exe
1224 7.0.0.0.exe

description	pid	process
Token: SeDebugPrivilege	1224	7.0.0.0.exe

pid	process
1224	7.0.0.0.exe
1224	7.0.0.0.exe

C:\Users\Admin\AppData\Local\Temp\7.0.0.0.exe
"C:\Users\Admin\AppData\Local\Temp\7.0.0.0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\53b4dde3-ceef-4149-b63d-4b67cc36c3e9\GunaDotNetRT.dll
Filesize
136KB

MD5
9af5eb006bb0bab7f226272d82c896c7

SHA1
c2a5bb42a5f08f4dc821be374b700652262308f0

SHA256
77dc05a6bda90757f66552ee3f469b09f1e00732b4edca0f542872fb591ed9db

SHA512
7badd41be4c1039302fda9bba19d374ec9446ce24b7db33b66bee4ef38180d1abcd666d2aea468e7e452aa1e1565eedfefed582bf1c2fe477a4171d99d48772a

Download Submit
memory/1224-60-0x0000000074030000-0x0000000074067000-memory.dmp

Filesize
220KB

Download
memory/1224-56-0x0000000076291000-0x0000000076293000-memory.dmp

Filesize
8KB

Download
memory/1224-57-0x0000000008FB0000-0x00000000091FC000-memory.dmp

Filesize
2.3MB

Download
memory/1224-55-0x0000000007720000-0x0000000007E48000-memory.dmp

Filesize
7.2MB

Download
memory/1224-59-0x0000000074E20000-0x0000000074EA0000-memory.dmp

Filesize
512KB

Download
memory/1224-54-0x0000000001360000-0x00000000019D8000-memory.dmp

Filesize
6.5MB

Download
memory/1224-61-0x0000000009390000-0x00000000094AA000-memory.dmp

Filesize
1.1MB

Download
memory/1224-62-0x0000000000520000-0x0000000000586000-memory.dmp

Filesize
408KB

Download
memory/1224-63-0x0000000000A00000-0x0000000000A62000-memory.dmp

Filesize
392KB

Download
memory/1224-64-0x0000000000B50000-0x0000000000B5A000-memory.dmp

Filesize
40KB

Download
memory/1224-65-0x0000000009AB0000-0x0000000009AD6000-memory.dmp

Filesize
152KB

Download
memory/1224-66-0x0000000005098000-0x00000000050A9000-memory.dmp

Filesize
68KB

Download
memory/1224-67-0x0000000074030000-0x0000000074067000-memory.dmp

Filesize
220KB

Download