Overview

overview

7

Static

static

3

Ambrosial.exe

windows7-x64

4

Ambrosial.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    151s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-05-2023 15:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Ambrosial.exe

  • Size

    15.9MB

  • MD5

    596b0f4684d45de83c204967c06e48a3

  • SHA1

    933dc2dc29a17a9447c944289fed4f98e0eb5e5f

  • SHA256

    6ff53b8187d0d3e287ad9ce3da20eca4f9dd105a2e3421ca1ad73b533ec4b91a

  • SHA512

    8f50098d120d32a84347a8337dee27061a6914d66b951f930d491a81a9804317318f25f80467684fd4fecea6bccc6de38b2df3ee2742a54805f2cdb4413d3830

  • SSDEEP

    196608:64WxsIO2gfRMhSE8/Erd8QP+ih91qBpodTAIRq+2vBt:64WuIO2gfRMYbcr6QP391qBafC

Score
7/10
agilenet

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Obfuscated with Agile.Net obfuscator 32 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe
    "C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1068

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Ambrosial\assets\clients\1.19.3004.0\Zephyr Classic\launcherAssets\ProjectHalcyon.png
    Filesize

    54KB

    MD5

    cf4b10cab822fb4e563d5c1fc7757a30

    SHA1

    57328884b3e1ebf4eaeb4715a33bf93a52c95d53

    SHA256

    abb9e95c2b6bf7f7fad5f483b9e3e746bbca54a82ff79009d0760dcd2ff013cc

    SHA512

    f0607ac012b3e86a56f63b9778bde661424e56b3b048f24c8d82b693fe673e860bf0225863f4f71915a1c8c5c83f3caa0de796a0059860d62e378e0b98135eb0

    Download Submit
  • C:\Users\Admin\AppData\Local\Ambrosial\log.txt
    Filesize

    1KB

    MD5

    001449b3f5ecaeb0e5270e2fcdd29a0c

    SHA1

    7e335dc7090674bfa366b839c561b1678f6491cd

    SHA256

    e8d30d2e36c9b69b839aa36aaf20c6c77ced264c356dbffe67731778c79c9bba

    SHA512

    07ab428277894d0c3042835abea2771fef82416896356232ef7e52a9f8b7c021d0cd101bde7925d56957079976531f13c6927c344af4245bfca666a8d05f288b

    Download Submit
  • C:\Users\Admin\AppData\Local\Ambrosial\log.txt
    Filesize

    3KB

    MD5

    95071679ab62484c35056e27e214d766

    SHA1

    2aad1df3b00f1040fd243c6eac0648e12ab8fd98

    SHA256

    a2a21459278d593f194c608e82751a5dce43247dbfe6e89a0df065c63f186224

    SHA512

    24e06049912f6ab8e9c601a0680cd60e8dd890e485b5eb4885845494252126ac9fdbd832c34ff85c153cba5774574dec6684b89ea361b6ebf1dfcdf9983a7940

    Download Submit
  • C:\Users\Admin\AppData\Local\Ambrosial\log.txt
    Filesize

    3KB

    MD5

    b6fc9811af5e26c6b981426e20aca17c

    SHA1

    13ad8731b5ec8e5bf5df1a886913a271143e2011

    SHA256

    5ffa097d57364fb454bbe0a65e35267f6d394c8e85d9e2d0728ebbb777417ae5

    SHA512

    3b76d30a04e3aadf5d944b371b5dc1026b945d3aaa1c64b349d49331fa036bb8216cdc32bb4a294e86746015f80a847c49222a09e2bd6e8360ee0323c2514ef3

    Download Submit
  • C:\Users\Admin\AppData\Local\Ambrosial\log.txt
    Filesize

    4KB

    MD5

    b998aff444fc6c6883cd9db98a3f6dac

    SHA1

    6a9c54edcafce8557d9479ca5876ec2080740576

    SHA256

    76d521fb70c4ff936b17432f4091a81b4ad41ffb752d24a640fc09e333c0d389

    SHA512

    f4874e744af75d4f786dcf37ca18baf1d1ef8f7b647bbd5d50aa55eaaf7eaf9fe972872324702661a982833b77a4604062afce33e11dc586304df2d27356f223

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\0e1a63fc-9228-4b4f-96fc-fee060f96e92\GunaDotNetRT64.dll
    Filesize

    142KB

    MD5

    9c43f77cb7cff27cb47ed67babe3eda5

    SHA1

    b0400cf68249369d21de86bd26bb84ccffd47c43

    SHA256

    f25b9288fe370dcfcb4823fb4e44ab88c7f5fce6e137d0dba389a3dba07d621e

    SHA512

    cde6fb6cf8db6f9746e69e6c10214e60b3646700d70b49668a2a792e309714dd2d4c5a5241977a833a95fcde8318abcc89eb9968a5039a0b75726bbfa27125a7

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\0e1a63fc-9228-4b4f-96fc-fee060f96e92\GunaDotNetRT64.dll
    Filesize

    142KB

    MD5

    9c43f77cb7cff27cb47ed67babe3eda5

    SHA1

    b0400cf68249369d21de86bd26bb84ccffd47c43

    SHA256

    f25b9288fe370dcfcb4823fb4e44ab88c7f5fce6e137d0dba389a3dba07d621e

    SHA512

    cde6fb6cf8db6f9746e69e6c10214e60b3646700d70b49668a2a792e309714dd2d4c5a5241977a833a95fcde8318abcc89eb9968a5039a0b75726bbfa27125a7

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\Azonix.otf
    Filesize

    11KB

    MD5

    cdfe47b31e9184a55cf02eef1baf7240

    SHA1

    b8825c605434d572f5277be0283d5a9b2cde59e4

    SHA256

    51a65e5c09bf27980adf640cb54cb2a5bbb217fdaab79b377e158f92533362a9

    SHA512

    a2e5141c0f7ca72bcf5b1a303fce1734953d83ad363d4c3c7d8786e1bfd872a6b96eeabce3740b547a5447e255415cdf688a0d2074cecfaa0c54c49d0f2882c5

    Download Submit
  • C:\Windows\Fonts\OpenSansLight.ttf
    Filesize

    217KB

    MD5

    1bf71be111189e76987a4bb9b3115cb7

    SHA1

    40442c189568184b6e6c27a25d69f14d91b65039

    SHA256

    cf5f5184c1441a1660aa52526328e9d5c2793e77b6d8d3a3ad654bdb07ab8424

    SHA512

    cb18b69e98a194af5e3e3d982a75254f3a20bd94c68816a15f38870b9be616cef0c32033f253219cca9146b2b419dd6df28cc4ceeff80d01f400aa0ed101e061

    Download Submit
  • memory/1068-390-0x00000205E8B10000-0x00000205E8CF4000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1068-398-0x00000205E8B10000-0x00000205E8CF4000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1068-155-0x00000205CCD40000-0x00000205CCD50000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1068-134-0x00000205CCD90000-0x00000205CCDAA000-memory.dmp
    Filesize

    104KB

    Download
  • memory/1068-371-0x00007FFD71E70000-0x00007FFD71FBE000-memory.dmp
    Filesize

    1.3MB

    Download
  • memory/1068-372-0x00000205E8B10000-0x00000205E8CF4000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1068-373-0x00000205E8B10000-0x00000205E8CF4000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1068-375-0x00000205E8B10000-0x00000205E8CF4000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1068-377-0x00000205E8B10000-0x00000205E8CF4000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1068-379-0x00000205E8B10000-0x00000205E8CF4000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1068-381-0x00000205E8B10000-0x00000205E8CF4000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1068-383-0x00000205E8B10000-0x00000205E8CF4000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1068-385-0x00000205E8B10000-0x00000205E8CF4000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1068-388-0x00000205E8B10000-0x00000205E8CF4000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1068-387-0x00007FFD6D020000-0x00007FFD6D047000-memory.dmp
    Filesize

    156KB

    Download
  • memory/1068-133-0x00000205CB870000-0x00000205CC85A000-memory.dmp
    Filesize

    15.9MB

    Download
  • memory/1068-392-0x00000205E8B10000-0x00000205E8CF4000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1068-394-0x00000205E8B10000-0x00000205E8CF4000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1068-396-0x00000205E8B10000-0x00000205E8CF4000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1068-164-0x00000205E6F80000-0x00000205E6FA2000-memory.dmp
    Filesize

    136KB

    Download
  • memory/1068-400-0x00000205E8B10000-0x00000205E8CF4000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1068-402-0x00000205E8B10000-0x00000205E8CF4000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1068-404-0x00000205E8B10000-0x00000205E8CF4000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1068-406-0x00000205E8B10000-0x00000205E8CF4000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1068-408-0x00000205E8B10000-0x00000205E8CF4000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1068-410-0x00000205E8B10000-0x00000205E8CF4000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1068-412-0x00000205E8B10000-0x00000205E8CF4000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1068-414-0x00000205E8B10000-0x00000205E8CF4000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1068-416-0x00000205E8B10000-0x00000205E8CF4000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1068-418-0x00000205E8B10000-0x00000205E8CF4000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1068-420-0x00000205E8B10000-0x00000205E8CF4000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1068-422-0x00000205E8B10000-0x00000205E8CF4000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1068-424-0x00000205E8B10000-0x00000205E8CF4000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1068-426-0x00000205E8B10000-0x00000205E8CF4000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1068-428-0x00000205E8B10000-0x00000205E8CF4000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1068-430-0x00000205E8B10000-0x00000205E8CF4000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1068-432-0x00000205E8B10000-0x00000205E8CF4000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1068-434-0x00000205E8B10000-0x00000205E8CF4000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/1068-614-0x00000205CCD40000-0x00000205CCD50000-memory.dmp
    Filesize

    64KB

    Download