daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964

Analysis

max time kernel
47s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 15:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
Size

937KB
MD5

0902ca5a76c519c6a404218b62bf9103
SHA1

f1e7192a646589eb9a24ab6bd4508dda03946423
SHA256

daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964
SHA512

cd9e00c07389f801be53ed67826902d43e8cb2724eaca1ea5c660776768596e95d8f9fbb998f357c9f7576fa1e02c40f8028d5d7cec469f4abc38efd087ca4e8
SSDEEP

12288:Dsr2nXNv6qE3RIDDGFNuDj44aCy712bxLIIIIIIIIIIIIIIIIIOOOgOOOOOOOOOC:gWl66D6X4aCO12Jqbsam09

Score

7^/10

agilenet

Malware Config

Signatures

Obfuscated with Agile.Net obfuscator 4 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/1512-63-0x0000000000400000-0x0000000000476000-memory.dmp	agile_net
behavioral1/memory/1512-64-0x000000000047400A-mapping.dmp	agile_net
behavioral1/memory/1512-66-0x0000000000400000-0x0000000000476000-memory.dmp	agile_net
behavioral1/memory/1512-68-0x0000000000400000-0x0000000000476000-memory.dmp	agile_net

Suspicious use of SetThreadContext 2 IoCs

Processes:

daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exedaaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe

description	pid	process	target process
PID 1112 set thread context of 1976	1112	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
PID 1492 set thread context of 1512	1492	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exedaaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe

pid	process
1112	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
1112	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
1492	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
1492	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exedaaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe

description	pid	process
Token: SeDebugPrivilege	1112	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
Token: SeDebugPrivilege	1492	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exedaaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exedaaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe

C:\Users\Admin\AppData\Local\Temp\daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
"C:\Users\Admin\AppData\Local\Temp\daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1112

C:\Users\Admin\AppData\Local\Temp\daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
C:\Users\Admin\AppData\Local\Temp\daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
2⤵
PID:1976

C:\Users\Admin\AppData\Local\Temp\daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
"C:\Users\Admin\AppData\Local\Temp\daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1492

C:\Users\Admin\AppData\Local\Temp\daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
C:\Users\Admin\AppData\Local\Temp\daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1512

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 416
4⤵
PID:452

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/452-72-0x0000000000000000-mapping.dmp

Download
memory/1112-61-0x00000000747F0000-0x0000000074D9B000-memory.dmp

Filesize
5.7MB

Download
memory/1112-55-0x00000000747F0000-0x0000000074D9B000-memory.dmp

Filesize
5.7MB

Download
memory/1112-56-0x00000000747F0000-0x0000000074D9B000-memory.dmp

Filesize
5.7MB

Download
memory/1112-54-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download
memory/1492-62-0x00000000747F0000-0x0000000074D9B000-memory.dmp

Filesize
5.7MB

Download
memory/1492-69-0x00000000747F0000-0x0000000074D9B000-memory.dmp

Filesize
5.7MB

Download
memory/1492-57-0x0000000000000000-mapping.dmp

Download
memory/1512-63-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1512-64-0x000000000047400A-mapping.dmp

Download
memory/1512-66-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1512-68-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1512-73-0x0000000074240000-0x00000000747EB000-memory.dmp

Filesize
5.7MB

Download
memory/1512-75-0x0000000074240000-0x00000000747EB000-memory.dmp

Filesize
5.7MB

Download
memory/1976-59-0x000000000047400A-mapping.dmp

Download

description	pid	process	target process
PID 1112 wrote to memory of 1976	1112	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
PID 1112 wrote to memory of 1976	1112	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
PID 1112 wrote to memory of 1976	1112	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
PID 1112 wrote to memory of 1976	1112	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
PID 1112 wrote to memory of 1976	1112	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
PID 1112 wrote to memory of 1492	1112	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
PID 1112 wrote to memory of 1492	1112	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
PID 1112 wrote to memory of 1492	1112	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
PID 1112 wrote to memory of 1492	1112	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
PID 1112 wrote to memory of 1976	1112	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
PID 1112 wrote to memory of 1976	1112	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
PID 1112 wrote to memory of 1976	1112	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
PID 1112 wrote to memory of 1976	1112	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
PID 1112 wrote to memory of 1976	1112	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
PID 1112 wrote to memory of 1976	1112	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
PID 1492 wrote to memory of 1512	1492	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
PID 1492 wrote to memory of 1512	1492	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
PID 1492 wrote to memory of 1512	1492	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
PID 1492 wrote to memory of 1512	1492	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
PID 1492 wrote to memory of 1512	1492	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
PID 1492 wrote to memory of 1512	1492	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
PID 1492 wrote to memory of 1512	1492	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
PID 1492 wrote to memory of 1512	1492	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
PID 1492 wrote to memory of 1512	1492	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
PID 1492 wrote to memory of 1512	1492	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
PID 1492 wrote to memory of 1512	1492	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe
PID 1512 wrote to memory of 452	1512	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe	dw20.exe
PID 1512 wrote to memory of 452	1512	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe	dw20.exe
PID 1512 wrote to memory of 452	1512	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe	dw20.exe
PID 1512 wrote to memory of 452	1512	daaf00fee60bf78ad3fc0f9f1672b72ec4543e76a09a34177c521d3d493a3964.exe	dw20.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads