Analysis

  • max time kernel
    143s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    09/04/2023, 18:18

General

  • Target

    SAMTOOL.exe

  • Size

    5.0MB

  • MD5

    01ec71d7c98cbd68b6bfb26efad47ed6

  • SHA1

    0c683f934438391c434e130073aae85ce5cb2c07

  • SHA256

    792aa3b430a6f897d5b201553a3421acff0d0a6aacfbf9ddfd6134cafb571cef

  • SHA512

    9190286483f90a2f4367ad989f98b440b6c4a6fc02d66610df5d3eec9fd4b5fd1106c48f47c0735953644ea5cfdc80b84c7bd3ee7e9f7f61745fcb7ccde441d3

  • SSDEEP

    98304:EKUNmlnsLSU/hsNLqeAhGB69t5QZPcN1XrbtBv3Y97fDh6/bGS:wIlslu1go0taZEfYpfk/

Score
7/10

Malware Config

Signatures

  • Obfuscated with Agile.Net obfuscator 10 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Suspicious behavior: EnumeratesProcesses 59 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SAMTOOL.exe
    "C:\Users\Admin\AppData\Local\Temp\SAMTOOL.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1300
    • C:\Users\Admin\AppData\Local\Temp\ADB\adb.exe
      "C:\Users\Admin\AppData\Local\Temp\ADB\adb.exe" version
      2⤵
        PID:1504
      • C:\Users\Admin\AppData\Local\Temp\ADB\adb.exe
        "C:\Users\Admin\AppData\Local\Temp\ADB\adb.exe" start-server
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:388
        • C:\Users\Admin\AppData\Local\Temp\ADB\adb.exe
          adb -L tcp:5037 fork-server server --reply-fd 256
          3⤵
            PID:852

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/388-78-0x0000000000400000-0x00000000005E7000-memory.dmp

              Filesize

              1.9MB

            • memory/852-84-0x0000000000400000-0x00000000005E7000-memory.dmp

              Filesize

              1.9MB

            • memory/852-83-0x0000000000400000-0x00000000005E7000-memory.dmp

              Filesize

              1.9MB

            • memory/852-81-0x0000000000400000-0x00000000005E7000-memory.dmp

              Filesize

              1.9MB

            • memory/1300-66-0x0000000000400000-0x0000000000440000-memory.dmp

              Filesize

              256KB

            • memory/1300-70-0x0000000009E80000-0x0000000009EAC000-memory.dmp

              Filesize

              176KB

            • memory/1300-60-0x00000000049F0000-0x0000000004A10000-memory.dmp

              Filesize

              128KB

            • memory/1300-62-0x0000000004A10000-0x0000000004A1E000-memory.dmp

              Filesize

              56KB

            • memory/1300-61-0x0000000004F50000-0x0000000004FAA000-memory.dmp

              Filesize

              360KB

            • memory/1300-63-0x0000000004A20000-0x0000000004A3E000-memory.dmp

              Filesize

              120KB

            • memory/1300-64-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

              Filesize

              64KB

            • memory/1300-65-0x00000000050F0000-0x000000000523E000-memory.dmp

              Filesize

              1.3MB

            • memory/1300-54-0x0000000000AE0000-0x0000000000FEE000-memory.dmp

              Filesize

              5.1MB

            • memory/1300-67-0x0000000006060000-0x0000000006286000-memory.dmp

              Filesize

              2.1MB

            • memory/1300-68-0x0000000000400000-0x0000000000440000-memory.dmp

              Filesize

              256KB

            • memory/1300-59-0x00000000049D0000-0x00000000049F0000-memory.dmp

              Filesize

              128KB

            • memory/1300-71-0x000000000D0A0000-0x000000000D0B0000-memory.dmp

              Filesize

              64KB

            • memory/1300-72-0x000000000D120000-0x000000000D13A000-memory.dmp

              Filesize

              104KB

            • memory/1300-73-0x0000000005F90000-0x0000000005F98000-memory.dmp

              Filesize

              32KB

            • memory/1300-55-0x0000000000440000-0x000000000045E000-memory.dmp

              Filesize

              120KB

            • memory/1300-58-0x0000000000A60000-0x0000000000A7C000-memory.dmp

              Filesize

              112KB

            • memory/1300-79-0x0000000000400000-0x0000000000440000-memory.dmp

              Filesize

              256KB

            • memory/1300-80-0x0000000000400000-0x0000000000440000-memory.dmp

              Filesize

              256KB

            • memory/1300-57-0x0000000000400000-0x0000000000440000-memory.dmp

              Filesize

              256KB

            • memory/1300-82-0x0000000000400000-0x0000000000440000-memory.dmp

              Filesize

              256KB

            • memory/1300-56-0x0000000004580000-0x00000000045EE000-memory.dmp

              Filesize

              440KB

            • memory/1504-74-0x0000000000400000-0x00000000005E7000-memory.dmp

              Filesize

              1.9MB