hxxps://filebin[.]net/ojm6k869nnydvm8p/AGLoader[.]exe

Analysis

max time kernel
97s
max time network
100s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
12-10-2022 17:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://filebin.net/ojm6k869nnydvm8p/AGLoader.exe

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	CSGO_External.exe

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
4712	AGLoader.exe
504	CSGO_External.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	CSGO_External.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	CSGO_External.exe

Loads dropped DLL 1 IoCs

pid	Process
4712	AGLoader.exe

Themida packer 8 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x000a00000001aceb-135.dat	themida
behavioral1/files/0x000a00000001aceb-142.dat	themida
behavioral1/memory/504-144-0x0000000000A50000-0x0000000001C39000-memory.dmp	themida
behavioral1/memory/504-174-0x0000000000A50000-0x0000000001C39000-memory.dmp	themida
behavioral1/memory/504-175-0x0000000000A50000-0x0000000001C39000-memory.dmp	themida
behavioral1/memory/504-176-0x0000000000A50000-0x0000000001C39000-memory.dmp	themida
behavioral1/memory/504-177-0x0000000000A50000-0x0000000001C39000-memory.dmp	themida
behavioral1/memory/504-188-0x0000000000A50000-0x0000000001C39000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	CSGO_External.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
504	CSGO_External.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4164	chrome.exe
4164	chrome.exe
2484	chrome.exe
2484	chrome.exe
4844	chrome.exe
4844	chrome.exe
4036	chrome.exe
4036	chrome.exe
4692	chrome.exe
4692	chrome.exe
4752	chrome.exe
4092	chrome.exe
4752	chrome.exe
4092	chrome.exe
1748	chrome.exe
1748	chrome.exe
96	chrome.exe
96	chrome.exe
2484	chrome.exe
2484	chrome.exe
4660	chrome.exe
4660	chrome.exe
504	CSGO_External.exe
504	CSGO_External.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
504	CSGO_External.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4712	AGLoader.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe
2484	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2820	2484	chrome.exe	66
PID 2484 wrote to memory of 2820	2484	chrome.exe	66
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 1404	2484	chrome.exe	69
PID 2484 wrote to memory of 4164	2484	chrome.exe	68
PID 2484 wrote to memory of 4164	2484	chrome.exe	68
PID 2484 wrote to memory of 1040	2484	chrome.exe	70
PID 2484 wrote to memory of 1040	2484	chrome.exe	70
PID 2484 wrote to memory of 1040	2484	chrome.exe	70
PID 2484 wrote to memory of 1040	2484	chrome.exe	70
PID 2484 wrote to memory of 1040	2484	chrome.exe	70
PID 2484 wrote to memory of 1040	2484	chrome.exe	70
PID 2484 wrote to memory of 1040	2484	chrome.exe	70
PID 2484 wrote to memory of 1040	2484	chrome.exe	70
PID 2484 wrote to memory of 1040	2484	chrome.exe	70
PID 2484 wrote to memory of 1040	2484	chrome.exe	70
PID 2484 wrote to memory of 1040	2484	chrome.exe	70
PID 2484 wrote to memory of 1040	2484	chrome.exe	70
PID 2484 wrote to memory of 1040	2484	chrome.exe	70
PID 2484 wrote to memory of 1040	2484	chrome.exe	70
PID 2484 wrote to memory of 1040	2484	chrome.exe	70
PID 2484 wrote to memory of 1040	2484	chrome.exe	70
PID 2484 wrote to memory of 1040	2484	chrome.exe	70
PID 2484 wrote to memory of 1040	2484	chrome.exe	70
PID 2484 wrote to memory of 1040	2484	chrome.exe	70
PID 2484 wrote to memory of 1040	2484	chrome.exe	70

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://filebin.net/ojm6k869nnydvm8p/AGLoader.exe
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffdd8cd4f50,0x7ffdd8cd4f60,0x7ffdd8cd4f70
  2⤵
  PID:2820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,1911976445297280539,2095213890585621606,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1676 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1536,1911976445297280539,2095213890585621606,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1560 /prefetch:2
  2⤵
  PID:1404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1536,1911976445297280539,2095213890585621606,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2280 /prefetch:8
  2⤵
  PID:1040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,1911976445297280539,2095213890585621606,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2816 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,1911976445297280539,2095213890585621606,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2808 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1536,1911976445297280539,2095213890585621606,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4064 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1536,1911976445297280539,2095213890585621606,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4696 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1536,1911976445297280539,2095213890585621606,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4692 /prefetch:8
  2⤵
  PID:716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,1911976445297280539,2095213890585621606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1536,1911976445297280539,2095213890585621606,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,1911976445297280539,2095213890585621606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1536,1911976445297280539,2095213890585621606,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1536,1911976445297280539,2095213890585621606,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1536,1911976445297280539,2095213890585621606,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,1911976445297280539,2095213890585621606,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1536,1911976445297280539,2095213890585621606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1536,1911976445297280539,2095213890585621606,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1536,1911976445297280539,2095213890585621606,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:3732
- C:\Users\Admin\Downloads\AGLoader.exe
  "C:\Users\Admin\Downloads\AGLoader.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:4712
- - C:\Users\Admin\AppData\Roaming\AGLoader\CSGO_External.exe
    "C:\Users\Admin\AppData\Roaming\AGLoader\CSGO_External.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    PID:504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,1911976445297280539,2095213890585621606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,1911976445297280539,2095213890585621606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,1911976445297280539,2095213890585621606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=852 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,1911976445297280539,2095213890585621606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:96
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1536,1911976445297280539,2095213890585621606,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,1911976445297280539,2095213890585621606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1536,1911976445297280539,2095213890585621606,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1016 /prefetch:8
  2⤵
  PID:744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\AGLoader\CSGO_External.exe

Filesize
7.4MB

MD5
a39a7cd4012ba61a209e6636f07eca5c

SHA1
a10a3a7a20ac32606ff508cad5c7f624c8365021

SHA256
feb583ceb7baa0594d2203334fceb9820f7ec00827d97f689a229e8b6df64bb8

SHA512
674ab6766bd6ff86a7d87efcd0ef2e306df7e7c0aad50f19c685025e6bc827eedc376bd056570168f8e55d65d8a679e92fa145fbca3ea4c94c247402989ddea3

Download Submit
C:\Users\Admin\AppData\Roaming\AGLoader\CSGO_External.exe

Filesize
7.4MB

MD5
a39a7cd4012ba61a209e6636f07eca5c

SHA1
a10a3a7a20ac32606ff508cad5c7f624c8365021

SHA256
feb583ceb7baa0594d2203334fceb9820f7ec00827d97f689a229e8b6df64bb8

SHA512
674ab6766bd6ff86a7d87efcd0ef2e306df7e7c0aad50f19c685025e6bc827eedc376bd056570168f8e55d65d8a679e92fa145fbca3ea4c94c247402989ddea3

Download Submit
C:\Users\Admin\Downloads\AGLoader.exe

Filesize
10.0MB

MD5
7487110c1bf13180a9e326c82b82d503

SHA1
08a2280590d05d96bff74b5e9bbd702fcac1dca8

SHA256
ed11d91b1477ed91d9a296eac7573cd79506b7ccf94d9549977f84a8667b2684

SHA512
8e02fc657bc7946e6623e8ab54a89775146e588bb4456e6b740d02ff3f2317b0973987e8dd9c3e31d4f9d46575fd9513b07517588cd9eed7bb93276cc77bf9b5

Download Submit
C:\Users\Admin\Downloads\AGLoader.exe

Filesize
10.0MB

MD5
7487110c1bf13180a9e326c82b82d503

SHA1
08a2280590d05d96bff74b5e9bbd702fcac1dca8

SHA256
ed11d91b1477ed91d9a296eac7573cd79506b7ccf94d9549977f84a8667b2684

SHA512
8e02fc657bc7946e6623e8ab54a89775146e588bb4456e6b740d02ff3f2317b0973987e8dd9c3e31d4f9d46575fd9513b07517588cd9eed7bb93276cc77bf9b5

Download Submit
\Users\Admin\AppData\Local\Temp\32a4a32f-b10a-42fc-a699-939a32e55fe5\SiticoneDotNetRT64.dll

Filesize
142KB

MD5
9c43f77cb7cff27cb47ed67babe3eda5

SHA1
b0400cf68249369d21de86bd26bb84ccffd47c43

SHA256
f25b9288fe370dcfcb4823fb4e44ab88c7f5fce6e137d0dba389a3dba07d621e

SHA512
cde6fb6cf8db6f9746e69e6c10214e60b3646700d70b49668a2a792e309714dd2d4c5a5241977a833a95fcde8318abcc89eb9968a5039a0b75726bbfa27125a7

Download Submit
memory/504-157-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-136-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-161-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-188-0x0000000000A50000-0x0000000001C39000-memory.dmp

Filesize
17.9MB

Download
memory/504-187-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-186-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-185-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-184-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-137-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-138-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-139-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-140-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-141-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-162-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-143-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-145-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-146-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-147-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-148-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-149-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-144-0x0000000000A50000-0x0000000001C39000-memory.dmp

Filesize
17.9MB

Download
memory/504-150-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-151-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-152-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-153-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-154-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-155-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-156-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-158-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-159-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-183-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-182-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-160-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-163-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-165-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-167-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-169-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-170-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-171-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-173-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-172-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-168-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-166-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-164-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-174-0x0000000000A50000-0x0000000001C39000-memory.dmp

Filesize
17.9MB

Download
memory/504-175-0x0000000000A50000-0x0000000001C39000-memory.dmp

Filesize
17.9MB

Download
memory/504-176-0x0000000000A50000-0x0000000001C39000-memory.dmp

Filesize
17.9MB

Download
memory/504-177-0x0000000000A50000-0x0000000001C39000-memory.dmp

Filesize
17.9MB

Download
memory/504-178-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-179-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-180-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/504-181-0x0000000077D90000-0x0000000077F1E000-memory.dmp

Filesize
1.6MB

Download
memory/4712-131-0x000002042E420000-0x000002042E446000-memory.dmp

Filesize
152KB

Download
memory/4712-130-0x000002040D410000-0x000002040D42C000-memory.dmp

Filesize
112KB

Download
memory/4712-129-0x00007FFDD1970000-0x00007FFDD1997000-memory.dmp

Filesize
156KB

Download
memory/4712-128-0x00007FFDC3650000-0x00007FFDC377C000-memory.dmp

Filesize
1.2MB

Download
memory/4712-126-0x0000020428550000-0x00000204286F8000-memory.dmp

Filesize
1.7MB

Download
memory/4712-125-0x0000020428170000-0x0000020428546000-memory.dmp

Filesize
3.8MB

Download
memory/4712-124-0x000002040C420000-0x000002040CE24000-memory.dmp

Filesize
10.0MB

Download
memory/4712-132-0x00007FFDD1970000-0x00007FFDD1997000-memory.dmp

Filesize
156KB

Download
memory/4712-133-0x000002042FE80000-0x000002042FE8A000-memory.dmp

Filesize
40KB

Download