02cc6945c8a524424cf8f399905e53ca88f505c54ed425a92a1e95b2d31b2d9d

Analysis

max time kernel
151s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19-03-2023 06:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Consumer_p_.exe
Size

31.9MB
MD5

f077fe80c3a20870c75c3eb8464eb360
SHA1

3c212a8ec8b7c8b3e69340b69d2ac4e690ec4a6c
SHA256

02cc6945c8a524424cf8f399905e53ca88f505c54ed425a92a1e95b2d31b2d9d
SHA512

e1f4e97d26dd19b465e62cea2aebf58ca0857aa8575e288665838e0073905001972614af9bb9518a5d2823a7dd6d16d4ed626c7c1266eaf347c9b8ce43cfc0ae
SSDEEP

786432:7LIPpTfGiQlJe01j3m3q2YA72qP/gqyT0s5:70PNfG5lJemjW3GA7xnu

Score

7^/10

agilenet

Malware Config

Signatures

Obfuscated with Agile.Net obfuscator 6 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/1920-55-0x0000000000E80000-0x000000000222A000-memory.dmp	agile_net
behavioral1/memory/1920-56-0x0000000000E80000-0x000000000222A000-memory.dmp	agile_net
behavioral1/memory/1920-60-0x0000000000E80000-0x000000000222A000-memory.dmp	agile_net
behavioral1/memory/1920-68-0x0000000000E80000-0x000000000222A000-memory.dmp	agile_net
behavioral1/memory/1920-85-0x0000000000E80000-0x000000000222A000-memory.dmp	agile_net
behavioral1/memory/1920-88-0x0000000000E80000-0x000000000222A000-memory.dmp	agile_net

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

Consumer_p_.exe

pid process

1920 Consumer_p_.exe
1920 Consumer_p_.exe
1920 Consumer_p_.exe
1920 Consumer_p_.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Consumer_p_.exe

pid process

1920 Consumer_p_.exe

pid	process
1920	Consumer_p_.exe
1920	Consumer_p_.exe
1920	Consumer_p_.exe
1920	Consumer_p_.exe

pid	process
1920	Consumer_p_.exe

C:\Users\Admin\AppData\Local\Temp\Consumer_p_.exe
"C:\Users\Admin\AppData\Local\Temp\Consumer_p_.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1920

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1920-54-0x000007FFFFA20000-0x000007FFFFBC7000-memory.dmp

Filesize
1.7MB

Download
memory/1920-55-0x0000000000E80000-0x000000000222A000-memory.dmp

Filesize
19.7MB

Download
memory/1920-56-0x0000000000E80000-0x000000000222A000-memory.dmp

Filesize
19.7MB

Download
memory/1920-57-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Filesize
3.8MB

Download
memory/1920-59-0x0000000077C10000-0x0000000077C20000-memory.dmp

Filesize
64KB

Download
memory/1920-58-0x0000000003A50000-0x0000000003A60000-memory.dmp

Filesize
64KB

Download
memory/1920-60-0x0000000000E80000-0x000000000222A000-memory.dmp

Filesize
19.7MB

Download
memory/1920-62-0x0000000180000000-0x000000018272B000-memory.dmp

Filesize
39.2MB

Download
memory/1920-63-0x0000000180000000-0x000000018272B000-memory.dmp

Filesize
39.2MB

Download
memory/1920-68-0x0000000000E80000-0x000000000222A000-memory.dmp

Filesize
19.7MB

Download
memory/1920-69-0x0000000180000000-0x000000018272B000-memory.dmp

Filesize
39.2MB

Download
memory/1920-70-0x0000000077C20000-0x0000000077C22000-memory.dmp

Filesize
8KB

Download
memory/1920-71-0x0000000077C20000-0x0000000077C22000-memory.dmp

Filesize
8KB

Download
memory/1920-72-0x0000000077C20000-0x0000000077C22000-memory.dmp

Filesize
8KB

Download
memory/1920-73-0x0000000077C40000-0x0000000077C42000-memory.dmp

Filesize
8KB

Download
memory/1920-74-0x0000000077C40000-0x0000000077C42000-memory.dmp

Filesize
8KB

Download
memory/1920-75-0x0000000077C40000-0x0000000077C42000-memory.dmp

Filesize
8KB

Download
memory/1920-76-0x0000000180000000-0x000000018272B000-memory.dmp

Filesize
39.2MB

Download
memory/1920-82-0x0000000180000000-0x000000018272B000-memory.dmp

Filesize
39.2MB

Download
memory/1920-85-0x0000000000E80000-0x000000000222A000-memory.dmp

Filesize
19.7MB

Download
memory/1920-88-0x0000000000E80000-0x000000000222A000-memory.dmp

Filesize
19.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads