Overview

overview

10

Static

static

7

13685be33c...c7.exe

windows7-x64

10

13685be33c...c7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    13685be33cc36747f500c5b392ae8f221e8264e45e1c7ff52865bdcbd4ec9cc7

  • Size

    1.3MB

  • Sample

    221127-gwjt6sec35

  • MD5

    01151ab7fc3222021cbab67f27622e8a

  • SHA1

    caf0c1ef61f2846fb527dcca0f58543c25bb7496

  • SHA256

    13685be33cc36747f500c5b392ae8f221e8264e45e1c7ff52865bdcbd4ec9cc7

  • SHA512

    4db207d0a06f7bfff31113e990082d33605c1afcc7f93128eb4b59293c3cb477c2293751fe8dcbbffb936142ccb1d783ceb154df69973ae5c6bac9210b21c7f8

  • SSDEEP

    24576:cxTAxn1eTrQj9JPc9H+XD6krOlfKtBX8y3xyh2h8Qr7Rdwm:cxO889J8MD6krOlfKtBXLz8Qr7Ram

Score
10/10
agilenetevasiontrojan

Malware Config

Targets

    • Target

      13685be33cc36747f500c5b392ae8f221e8264e45e1c7ff52865bdcbd4ec9cc7

    • Size

      1.3MB

    • MD5

      01151ab7fc3222021cbab67f27622e8a

    • SHA1

      caf0c1ef61f2846fb527dcca0f58543c25bb7496

    • SHA256

      13685be33cc36747f500c5b392ae8f221e8264e45e1c7ff52865bdcbd4ec9cc7

    • SHA512

      4db207d0a06f7bfff31113e990082d33605c1afcc7f93128eb4b59293c3cb477c2293751fe8dcbbffb936142ccb1d783ceb154df69973ae5c6bac9210b21c7f8

    • SSDEEP

      24576:cxTAxn1eTrQj9JPc9H+XD6krOlfKtBX8y3xyh2h8Qr7Rdwm:cxO889J8MD6krOlfKtBXLz8Qr7Ram

    Score
    10/10
    agilenetevasiontrojan

    • UAC bypass

      evasiontrojan

    • Executes dropped EXE

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Uses the VBS compiler for execution

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Scheduled Task

1
T1053

Persistence

Hidden Files and Directories

2
T1158

Scheduled Task

1
T1053

Privilege Escalation

Bypass User Account Control

1
T1088

Scheduled Task

1
T1053

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Modify Registry

2
T1112

Hidden Files and Directories

2
T1158

Scripting

1
T1064

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks