02f4d3da6bc4cf90a49cb8f5f3b2bfa3c44e6b5b57968867e51cf5fa5a41223e | Triage

Analysis

max time kernel
132s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2023 06:53

Sharing

Report Analysis Logs

General

Target

Instaler.exe
Size

700.0MB
MD5

d947600f37d613d0fefaa14d2eb0b323
SHA1

013afb3b1521c81e81aa3febd6b0135f670c8811
SHA256

02f4d3da6bc4cf90a49cb8f5f3b2bfa3c44e6b5b57968867e51cf5fa5a41223e
SHA512

d102e830f33ab194b9a127f0c3a12b8b8417d4954152f12637d4b423b5bc5c78c1e421fa1ed433193c1ad2f82dbdfc04adb15bcecb78b85dc999ddfd9ba725ba
SSDEEP

98304:OSGkflHBmOdEASFShkvj+ksRr7uUnDvY8:OJMcOdFUj+ksB3nDg8

Score

7^/10

agilenet

Malware Config

Signatures

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

Processes:

resource	yara_rule
behavioral2/memory/4276-132-0x0000000000390000-0x00000000006C2000-memory.dmp	agile_net

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Instaler.exe

description pid process

Token: SeDebugPrivilege 4276 Instaler.exe

C:\Users\Admin\AppData\Local\Temp\Instaler.exe
"C:\Users\Admin\AppData\Local\Temp\Instaler.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4276-132-0x0000000000390000-0x00000000006C2000-memory.dmp

Filesize
3.2MB

Download