Analysis
-
max time kernel
106s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
21-03-2023 14:43
General
-
Target
MultiBit/MultiBit.exe
-
Size
324KB
-
MD5
0f39821d5744907e68885862080c6234
-
SHA1
71e263f94a80d6cd1df1349c4a2202ef5f2518c3
-
SHA256
86f783a90ebc8f381e8c6484d412cce8e587d003856b522b271ca15691e9dd8b
-
SHA512
38299692594b995607987e1369d7c2c8913e8daec076b3779a61033093290e69fab1fb8cae0a83a80643a825f67b41a81eb17d21736054a656067ae8bcf93cbc
-
SSDEEP
3072:Ex+JMeg3Z0EeYesNKnXORQtmGWA68rdCbyzziT6hTnNPmxZjmsNKnXOZu:Ov4XORAmGc8rdCbkziksZ4XOZ
Score
7/10
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 3 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 42 IoCs
-
Suspicious use of SendNotifyMessage 40 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MultiBit\MultiBit.exe"C:\Users\Admin\AppData\Local\Temp\MultiBit\MultiBit.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1748-133-0x00000000007A0000-0x00000000007F6000-memory.dmpFilesize
344KB
-
memory/1748-134-0x0000000005660000-0x0000000005C04000-memory.dmpFilesize
5.6MB
-
memory/1748-135-0x00000000051A0000-0x0000000005232000-memory.dmpFilesize
584KB
-
memory/1748-136-0x00000000052E0000-0x00000000052F0000-memory.dmpFilesize
64KB
-
memory/1748-137-0x0000000005250000-0x000000000525A000-memory.dmpFilesize
40KB
-
memory/1748-138-0x0000000005270000-0x0000000005280000-memory.dmpFilesize
64KB
-
memory/1748-139-0x0000000005D20000-0x0000000005D2E000-memory.dmpFilesize
56KB
-
memory/1748-140-0x0000000006FE0000-0x000000000712A000-memory.dmpFilesize
1.3MB
-
memory/1748-141-0x0000000009720000-0x0000000009746000-memory.dmpFilesize
152KB
-
memory/1748-142-0x00000000052E0000-0x00000000052F0000-memory.dmpFilesize
64KB
-
memory/1748-143-0x00000000052E0000-0x00000000052F0000-memory.dmpFilesize
64KB
-
memory/1748-144-0x00000000052E0000-0x00000000052F0000-memory.dmpFilesize
64KB
-
memory/1748-145-0x00000000052E0000-0x00000000052F0000-memory.dmpFilesize
64KB
-
memory/1748-146-0x00000000052E0000-0x00000000052F0000-memory.dmpFilesize
64KB
-
memory/1748-147-0x00000000052E0000-0x00000000052F0000-memory.dmpFilesize
64KB
-
memory/1748-148-0x00000000052E0000-0x00000000052F0000-memory.dmpFilesize
64KB
-
memory/1748-149-0x00000000052E0000-0x00000000052F0000-memory.dmpFilesize
64KB
-
memory/1748-150-0x00000000052E0000-0x00000000052F0000-memory.dmpFilesize
64KB
-
memory/5024-151-0x0000018738B60000-0x0000018738B61000-memory.dmpFilesize
4KB
-
memory/5024-152-0x0000018738B60000-0x0000018738B61000-memory.dmpFilesize
4KB
-
memory/5024-153-0x0000018738B60000-0x0000018738B61000-memory.dmpFilesize
4KB
-
memory/5024-157-0x0000018738B60000-0x0000018738B61000-memory.dmpFilesize
4KB
-
memory/5024-158-0x0000018738B60000-0x0000018738B61000-memory.dmpFilesize
4KB
-
memory/5024-159-0x0000018738B60000-0x0000018738B61000-memory.dmpFilesize
4KB
-
memory/5024-160-0x0000018738B60000-0x0000018738B61000-memory.dmpFilesize
4KB
-
memory/5024-161-0x0000018738B60000-0x0000018738B61000-memory.dmpFilesize
4KB
-
memory/5024-162-0x0000018738B60000-0x0000018738B61000-memory.dmpFilesize
4KB
-
memory/5024-163-0x0000018738B60000-0x0000018738B61000-memory.dmpFilesize
4KB