Overview

overview

7

Static

static

1

Ambrosial (1).exe

windows7-x64

4

Ambrosial (1).exe

windows10-2004-x64

7

Analysis

  • max time kernel
    96s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-04-2023 14:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Ambrosial (1).exe

  • Size

    15.9MB

  • MD5

    596b0f4684d45de83c204967c06e48a3

  • SHA1

    933dc2dc29a17a9447c944289fed4f98e0eb5e5f

  • SHA256

    6ff53b8187d0d3e287ad9ce3da20eca4f9dd105a2e3421ca1ad73b533ec4b91a

  • SHA512

    8f50098d120d32a84347a8337dee27061a6914d66b951f930d491a81a9804317318f25f80467684fd4fecea6bccc6de38b2df3ee2742a54805f2cdb4413d3830

  • SSDEEP

    196608:64WxsIO2gfRMhSE8/Erd8QP+ih91qBpodTAIRq+2vBt:64WuIO2gfRMYbcr6QP391qBafC

Score
7/10
agilenet

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Obfuscated with Agile.Net obfuscator 32 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ambrosial (1).exe
    "C:\Users\Admin\AppData\Local\Temp\Ambrosial (1).exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4992
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:956

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Web Service

    1
    T1102

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Ambrosial\assets\clients\1.19.3004.0\Zephyr Classic\launcherAssets\ProjectHalcyon.png
      Filesize

      46KB

      MD5

      bd127f237b3f4a794308fc3576b495ad

      SHA1

      0a2ff256aa76a0deb134315e4a72844dabb37041

      SHA256

      59b60c0cd0e2f058fd06054fc3b546151c73930dfe605a2fb08dfd21086e6351

      SHA512

      2ac6ddd8e824017291c0b145434c06fbc2329135794eb6427915873ce940537055565c25cee03f531f862c931f58fc217d475ee8027e26a736e3f8ce46f4d8b6

      Download Submit
    • C:\Users\Admin\AppData\Local\Ambrosial\log.txt
      Filesize

      3KB

      MD5

      ff32edfe6b582b1862b7377a64dacae3

      SHA1

      eb728226760b6377baf5c17902b105ef21cc9074

      SHA256

      08ab2712c984d44b6bc372e4d50ad0d608985642807ab1465df060035919575c

      SHA512

      009b3f8190b0fa281d812422b43b5abf093a04f5a63e879fb4531e70242e76a25f1a7dc053b352727dd1871617b99f43c6ad1d55eab81d52dcf885d16c1d1e32

      Download Submit
    • C:\Users\Admin\AppData\Local\Ambrosial\log.txt
      Filesize

      4KB

      MD5

      7dec3d321d34ea50e6e0d1f3f5d282b1

      SHA1

      96d2e42972c22511292f288fa289e9bcaad5068a

      SHA256

      a6f220dfff9a7534d599749c9f04044847c7037292b71bb93111fcad237db375

      SHA512

      69b1d899af6bc9b2b7c8d45b9e28ee99e4315bf4ebbdf4f894bea414d940fef2c70572639a37ae0a4b9eedbc00d026c9472119dc2b79cf67439faf7868c8487e

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\0e1a63fc-9228-4b4f-96fc-fee060f96e92\GunaDotNetRT64.dll
      Filesize

      142KB

      MD5

      9c43f77cb7cff27cb47ed67babe3eda5

      SHA1

      b0400cf68249369d21de86bd26bb84ccffd47c43

      SHA256

      f25b9288fe370dcfcb4823fb4e44ab88c7f5fce6e137d0dba389a3dba07d621e

      SHA512

      cde6fb6cf8db6f9746e69e6c10214e60b3646700d70b49668a2a792e309714dd2d4c5a5241977a833a95fcde8318abcc89eb9968a5039a0b75726bbfa27125a7

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\0e1a63fc-9228-4b4f-96fc-fee060f96e92\GunaDotNetRT64.dll
      Filesize

      142KB

      MD5

      9c43f77cb7cff27cb47ed67babe3eda5

      SHA1

      b0400cf68249369d21de86bd26bb84ccffd47c43

      SHA256

      f25b9288fe370dcfcb4823fb4e44ab88c7f5fce6e137d0dba389a3dba07d621e

      SHA512

      cde6fb6cf8db6f9746e69e6c10214e60b3646700d70b49668a2a792e309714dd2d4c5a5241977a833a95fcde8318abcc89eb9968a5039a0b75726bbfa27125a7

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\Azonix.otf
      Filesize

      11KB

      MD5

      cdfe47b31e9184a55cf02eef1baf7240

      SHA1

      b8825c605434d572f5277be0283d5a9b2cde59e4

      SHA256

      51a65e5c09bf27980adf640cb54cb2a5bbb217fdaab79b377e158f92533362a9

      SHA512

      a2e5141c0f7ca72bcf5b1a303fce1734953d83ad363d4c3c7d8786e1bfd872a6b96eeabce3740b547a5447e255415cdf688a0d2074cecfaa0c54c49d0f2882c5

      Download Submit
    • C:\Windows\Fonts\OpenSansLight.ttf
      Filesize

      217KB

      MD5

      1bf71be111189e76987a4bb9b3115cb7

      SHA1

      40442c189568184b6e6c27a25d69f14d91b65039

      SHA256

      cf5f5184c1441a1660aa52526328e9d5c2793e77b6d8d3a3ad654bdb07ab8424

      SHA512

      cb18b69e98a194af5e3e3d982a75254f3a20bd94c68816a15f38870b9be616cef0c32033f253219cca9146b2b419dd6df28cc4ceeff80d01f400aa0ed101e061

      Download Submit
    • memory/4992-390-0x000002C1751B0000-0x000002C175394000-memory.dmp
      Filesize

      1.9MB

      Download
    • memory/4992-398-0x000002C1751B0000-0x000002C175394000-memory.dmp
      Filesize

      1.9MB

      Download
    • memory/4992-140-0x000002C1739C0000-0x000002C1739D0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4992-134-0x000002C159830000-0x000002C15984A000-memory.dmp
      Filesize

      104KB

      Download
    • memory/4992-371-0x00007FFF0D620000-0x00007FFF0D76E000-memory.dmp
      Filesize

      1.3MB

      Download
    • memory/4992-372-0x000002C1751B0000-0x000002C175394000-memory.dmp
      Filesize

      1.9MB

      Download
    • memory/4992-373-0x000002C1751B0000-0x000002C175394000-memory.dmp
      Filesize

      1.9MB

      Download
    • memory/4992-375-0x000002C1751B0000-0x000002C175394000-memory.dmp
      Filesize

      1.9MB

      Download
    • memory/4992-377-0x000002C1751B0000-0x000002C175394000-memory.dmp
      Filesize

      1.9MB

      Download
    • memory/4992-380-0x000002C1751B0000-0x000002C175394000-memory.dmp
      Filesize

      1.9MB

      Download
    • memory/4992-379-0x00007FFF0C970000-0x00007FFF0C997000-memory.dmp
      Filesize

      156KB

      Download
    • memory/4992-382-0x000002C1751B0000-0x000002C175394000-memory.dmp
      Filesize

      1.9MB

      Download
    • memory/4992-384-0x000002C1751B0000-0x000002C175394000-memory.dmp
      Filesize

      1.9MB

      Download
    • memory/4992-386-0x000002C1751B0000-0x000002C175394000-memory.dmp
      Filesize

      1.9MB

      Download
    • memory/4992-388-0x000002C1751B0000-0x000002C175394000-memory.dmp
      Filesize

      1.9MB

      Download
    • memory/4992-133-0x000002C1582B0000-0x000002C15929A000-memory.dmp
      Filesize

      15.9MB

      Download
    • memory/4992-392-0x000002C1751B0000-0x000002C175394000-memory.dmp
      Filesize

      1.9MB

      Download
    • memory/4992-394-0x000002C1751B0000-0x000002C175394000-memory.dmp
      Filesize

      1.9MB

      Download
    • memory/4992-396-0x000002C1751B0000-0x000002C175394000-memory.dmp
      Filesize

      1.9MB

      Download
    • memory/4992-164-0x000002C15AFC0000-0x000002C15AFE2000-memory.dmp
      Filesize

      136KB

      Download
    • memory/4992-400-0x000002C1751B0000-0x000002C175394000-memory.dmp
      Filesize

      1.9MB

      Download
    • memory/4992-402-0x000002C1751B0000-0x000002C175394000-memory.dmp
      Filesize

      1.9MB

      Download
    • memory/4992-404-0x000002C1751B0000-0x000002C175394000-memory.dmp
      Filesize

      1.9MB

      Download
    • memory/4992-406-0x000002C1751B0000-0x000002C175394000-memory.dmp
      Filesize

      1.9MB

      Download
    • memory/4992-408-0x000002C1751B0000-0x000002C175394000-memory.dmp
      Filesize

      1.9MB

      Download
    • memory/4992-410-0x000002C1751B0000-0x000002C175394000-memory.dmp
      Filesize

      1.9MB

      Download
    • memory/4992-412-0x000002C1751B0000-0x000002C175394000-memory.dmp
      Filesize

      1.9MB

      Download
    • memory/4992-414-0x000002C1751B0000-0x000002C175394000-memory.dmp
      Filesize

      1.9MB

      Download
    • memory/4992-416-0x000002C1751B0000-0x000002C175394000-memory.dmp
      Filesize

      1.9MB

      Download
    • memory/4992-418-0x000002C1751B0000-0x000002C175394000-memory.dmp
      Filesize

      1.9MB

      Download
    • memory/4992-420-0x000002C1751B0000-0x000002C175394000-memory.dmp
      Filesize

      1.9MB

      Download
    • memory/4992-422-0x000002C1751B0000-0x000002C175394000-memory.dmp
      Filesize

      1.9MB

      Download
    • memory/4992-424-0x000002C1751B0000-0x000002C175394000-memory.dmp
      Filesize

      1.9MB

      Download
    • memory/4992-426-0x000002C1751B0000-0x000002C175394000-memory.dmp
      Filesize

      1.9MB

      Download
    • memory/4992-428-0x000002C1751B0000-0x000002C175394000-memory.dmp
      Filesize

      1.9MB

      Download
    • memory/4992-430-0x000002C1751B0000-0x000002C175394000-memory.dmp
      Filesize

      1.9MB

      Download
    • memory/4992-432-0x000002C1751B0000-0x000002C175394000-memory.dmp
      Filesize

      1.9MB

      Download
    • memory/4992-434-0x000002C1751B0000-0x000002C175394000-memory.dmp
      Filesize

      1.9MB

      Download
    • memory/4992-491-0x000002C1739C0000-0x000002C1739D0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4992-844-0x00007FFF0C970000-0x00007FFF0C997000-memory.dmp
      Filesize

      156KB

      Download