Malware Analysis Report

2025-06-15 21:21

Sample ID 230418-r84efsdh71
Target Ambrosial (1).exe
SHA256 6ff53b8187d0d3e287ad9ce3da20eca4f9dd105a2e3421ca1ad73b533ec4b91a
Tags
agilenet
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

6ff53b8187d0d3e287ad9ce3da20eca4f9dd105a2e3421ca1ad73b533ec4b91a

Threat Level: Shows suspicious behavior

The file Ambrosial (1).exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

agilenet

Obfuscated with Agile.Net obfuscator

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

Drops file in Windows directory

Program crash

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-04-18 14:52

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-04-18 14:52

Reported

2023-04-18 14:55

Platform

win7-20230220-en

Max time kernel

28s

Max time network

32s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Ambrosial (1).exe"

Signatures

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Fonts\Azonix.otf C:\Users\Admin\AppData\Local\Temp\Ambrosial (1).exe N/A
File opened for modification C:\Windows\Fonts\Azonix.otf C:\Users\Admin\AppData\Local\Temp\Ambrosial (1).exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\system32\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Ambrosial (1).exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1408 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\Ambrosial (1).exe C:\Windows\system32\WerFault.exe
PID 1408 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\Ambrosial (1).exe C:\Windows\system32\WerFault.exe
PID 1408 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\Ambrosial (1).exe C:\Windows\system32\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Ambrosial (1).exe

"C:\Users\Admin\AppData\Local\Temp\Ambrosial (1).exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 1408 -s 592

Network

N/A

Files

memory/1408-54-0x0000000000C90000-0x0000000001C7A000-memory.dmp

memory/1408-55-0x0000000000750000-0x000000000076C000-memory.dmp

memory/1408-56-0x0000000003210000-0x000000000322A000-memory.dmp

C:\Windows\Fonts\Azonix.otf

MD5 cdfe47b31e9184a55cf02eef1baf7240
SHA1 b8825c605434d572f5277be0283d5a9b2cde59e4
SHA256 51a65e5c09bf27980adf640cb54cb2a5bbb217fdaab79b377e158f92533362a9
SHA512 a2e5141c0f7ca72bcf5b1a303fce1734953d83ad363d4c3c7d8786e1bfd872a6b96eeabce3740b547a5447e255415cdf688a0d2074cecfaa0c54c49d0f2882c5

memory/1408-63-0x0000000000780000-0x0000000000800000-memory.dmp

memory/1408-64-0x0000000000780000-0x0000000000800000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-04-18 14:52

Reported

2023-04-18 14:54

Platform

win10v2004-20230220-en

Max time kernel

96s

Max time network

96s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Ambrosial (1).exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Ambrosial (1).exe N/A

Obfuscated with Agile.Net obfuscator

agilenet
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Legitimate hosting services abused for malware hosting/C2

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Fonts\Azonix.otf C:\Users\Admin\AppData\Local\Temp\Ambrosial (1).exe N/A
File opened for modification C:\Windows\Fonts\Azonix.otf C:\Users\Admin\AppData\Local\Temp\Ambrosial (1).exe N/A
File created C:\Windows\Fonts\OpenSansLight.ttf C:\Users\Admin\AppData\Local\Temp\Ambrosial (1).exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Ambrosial (1).exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Ambrosial (1).exe

"C:\Users\Admin\AppData\Local\Temp\Ambrosial (1).exe"

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
IE 20.54.89.15:443 tcp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.109.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 133.109.199.185.in-addr.arpa udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.130.233:443 cdn.discordapp.com tcp
US 8.8.8.8:53 233.130.159.162.in-addr.arpa udp
US 8.8.8.8:53 164.113.223.173.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 55.37.195.20.in-addr.arpa udp
US 8.8.8.8:53 42.220.44.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 2.36.159.162.in-addr.arpa udp
US 52.152.110.14:443 tcp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 20.189.173.3:443 tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
US 8.8.8.8:53 64.13.109.52.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 117.18.237.29:80 tcp
US 209.197.3.8:80 tcp

Files

memory/4992-133-0x000002C1582B0000-0x000002C15929A000-memory.dmp

memory/4992-134-0x000002C159830000-0x000002C15984A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Azonix.otf

MD5 cdfe47b31e9184a55cf02eef1baf7240
SHA1 b8825c605434d572f5277be0283d5a9b2cde59e4
SHA256 51a65e5c09bf27980adf640cb54cb2a5bbb217fdaab79b377e158f92533362a9
SHA512 a2e5141c0f7ca72bcf5b1a303fce1734953d83ad363d4c3c7d8786e1bfd872a6b96eeabce3740b547a5447e255415cdf688a0d2074cecfaa0c54c49d0f2882c5

memory/4992-140-0x000002C1739C0000-0x000002C1739D0000-memory.dmp

C:\Windows\Fonts\OpenSansLight.ttf

MD5 1bf71be111189e76987a4bb9b3115cb7
SHA1 40442c189568184b6e6c27a25d69f14d91b65039
SHA256 cf5f5184c1441a1660aa52526328e9d5c2793e77b6d8d3a3ad654bdb07ab8424
SHA512 cb18b69e98a194af5e3e3d982a75254f3a20bd94c68816a15f38870b9be616cef0c32033f253219cca9146b2b419dd6df28cc4ceeff80d01f400aa0ed101e061

memory/4992-164-0x000002C15AFC0000-0x000002C15AFE2000-memory.dmp

C:\Users\Admin\AppData\Local\Ambrosial\log.txt

MD5 ff32edfe6b582b1862b7377a64dacae3
SHA1 eb728226760b6377baf5c17902b105ef21cc9074
SHA256 08ab2712c984d44b6bc372e4d50ad0d608985642807ab1465df060035919575c
SHA512 009b3f8190b0fa281d812422b43b5abf093a04f5a63e879fb4531e70242e76a25f1a7dc053b352727dd1871617b99f43c6ad1d55eab81d52dcf885d16c1d1e32

C:\Users\Admin\AppData\Local\Ambrosial\log.txt

MD5 7dec3d321d34ea50e6e0d1f3f5d282b1
SHA1 96d2e42972c22511292f288fa289e9bcaad5068a
SHA256 a6f220dfff9a7534d599749c9f04044847c7037292b71bb93111fcad237db375
SHA512 69b1d899af6bc9b2b7c8d45b9e28ee99e4315bf4ebbdf4f894bea414d940fef2c70572639a37ae0a4b9eedbc00d026c9472119dc2b79cf67439faf7868c8487e

C:\Users\Admin\AppData\Local\Ambrosial\assets\clients\1.19.3004.0\Zephyr Classic\launcherAssets\ProjectHalcyon.png

MD5 bd127f237b3f4a794308fc3576b495ad
SHA1 0a2ff256aa76a0deb134315e4a72844dabb37041
SHA256 59b60c0cd0e2f058fd06054fc3b546151c73930dfe605a2fb08dfd21086e6351
SHA512 2ac6ddd8e824017291c0b145434c06fbc2329135794eb6427915873ce940537055565c25cee03f531f862c931f58fc217d475ee8027e26a736e3f8ce46f4d8b6

C:\Users\Admin\AppData\Local\Temp\0e1a63fc-9228-4b4f-96fc-fee060f96e92\GunaDotNetRT64.dll

MD5 9c43f77cb7cff27cb47ed67babe3eda5
SHA1 b0400cf68249369d21de86bd26bb84ccffd47c43
SHA256 f25b9288fe370dcfcb4823fb4e44ab88c7f5fce6e137d0dba389a3dba07d621e
SHA512 cde6fb6cf8db6f9746e69e6c10214e60b3646700d70b49668a2a792e309714dd2d4c5a5241977a833a95fcde8318abcc89eb9968a5039a0b75726bbfa27125a7

C:\Users\Admin\AppData\Local\Temp\0e1a63fc-9228-4b4f-96fc-fee060f96e92\GunaDotNetRT64.dll

MD5 9c43f77cb7cff27cb47ed67babe3eda5
SHA1 b0400cf68249369d21de86bd26bb84ccffd47c43
SHA256 f25b9288fe370dcfcb4823fb4e44ab88c7f5fce6e137d0dba389a3dba07d621e
SHA512 cde6fb6cf8db6f9746e69e6c10214e60b3646700d70b49668a2a792e309714dd2d4c5a5241977a833a95fcde8318abcc89eb9968a5039a0b75726bbfa27125a7

memory/4992-371-0x00007FFF0D620000-0x00007FFF0D76E000-memory.dmp

memory/4992-372-0x000002C1751B0000-0x000002C175394000-memory.dmp

memory/4992-373-0x000002C1751B0000-0x000002C175394000-memory.dmp

memory/4992-375-0x000002C1751B0000-0x000002C175394000-memory.dmp

memory/4992-377-0x000002C1751B0000-0x000002C175394000-memory.dmp

memory/4992-380-0x000002C1751B0000-0x000002C175394000-memory.dmp

memory/4992-379-0x00007FFF0C970000-0x00007FFF0C997000-memory.dmp

memory/4992-382-0x000002C1751B0000-0x000002C175394000-memory.dmp

memory/4992-384-0x000002C1751B0000-0x000002C175394000-memory.dmp

memory/4992-386-0x000002C1751B0000-0x000002C175394000-memory.dmp

memory/4992-388-0x000002C1751B0000-0x000002C175394000-memory.dmp

memory/4992-390-0x000002C1751B0000-0x000002C175394000-memory.dmp

memory/4992-392-0x000002C1751B0000-0x000002C175394000-memory.dmp

memory/4992-394-0x000002C1751B0000-0x000002C175394000-memory.dmp

memory/4992-396-0x000002C1751B0000-0x000002C175394000-memory.dmp

memory/4992-398-0x000002C1751B0000-0x000002C175394000-memory.dmp

memory/4992-400-0x000002C1751B0000-0x000002C175394000-memory.dmp

memory/4992-402-0x000002C1751B0000-0x000002C175394000-memory.dmp

memory/4992-404-0x000002C1751B0000-0x000002C175394000-memory.dmp

memory/4992-406-0x000002C1751B0000-0x000002C175394000-memory.dmp

memory/4992-408-0x000002C1751B0000-0x000002C175394000-memory.dmp

memory/4992-410-0x000002C1751B0000-0x000002C175394000-memory.dmp

memory/4992-412-0x000002C1751B0000-0x000002C175394000-memory.dmp

memory/4992-414-0x000002C1751B0000-0x000002C175394000-memory.dmp

memory/4992-416-0x000002C1751B0000-0x000002C175394000-memory.dmp

memory/4992-418-0x000002C1751B0000-0x000002C175394000-memory.dmp

memory/4992-420-0x000002C1751B0000-0x000002C175394000-memory.dmp

memory/4992-422-0x000002C1751B0000-0x000002C175394000-memory.dmp

memory/4992-424-0x000002C1751B0000-0x000002C175394000-memory.dmp

memory/4992-426-0x000002C1751B0000-0x000002C175394000-memory.dmp

memory/4992-428-0x000002C1751B0000-0x000002C175394000-memory.dmp

memory/4992-430-0x000002C1751B0000-0x000002C175394000-memory.dmp

memory/4992-432-0x000002C1751B0000-0x000002C175394000-memory.dmp

memory/4992-434-0x000002C1751B0000-0x000002C175394000-memory.dmp

memory/4992-491-0x000002C1739C0000-0x000002C1739D0000-memory.dmp

memory/4992-844-0x00007FFF0C970000-0x00007FFF0C997000-memory.dmp