Analysis
-
max time kernel
161s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
02-05-2023 15:22
Static task
static1
Behavioral task
behavioral1
Sample
Ambrosial.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Ambrosial.exe
Resource
win10v2004-20230220-en
General
-
Target
Ambrosial.exe
-
Size
15.9MB
-
MD5
596b0f4684d45de83c204967c06e48a3
-
SHA1
933dc2dc29a17a9447c944289fed4f98e0eb5e5f
-
SHA256
6ff53b8187d0d3e287ad9ce3da20eca4f9dd105a2e3421ca1ad73b533ec4b91a
-
SHA512
8f50098d120d32a84347a8337dee27061a6914d66b951f930d491a81a9804317318f25f80467684fd4fecea6bccc6de38b2df3ee2742a54805f2cdb4413d3830
-
SSDEEP
196608:64WxsIO2gfRMhSE8/Erd8QP+ih91qBpodTAIRq+2vBt:64WuIO2gfRMYbcr6QP391qBafC
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
Ambrosial.exepid process 1668 Ambrosial.exe -
Obfuscated with Agile.Net obfuscator 32 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/1668-372-0x0000025E81B20000-0x0000025E81D04000-memory.dmp agile_net behavioral2/memory/1668-373-0x0000025E81B20000-0x0000025E81D04000-memory.dmp agile_net behavioral2/memory/1668-375-0x0000025E81B20000-0x0000025E81D04000-memory.dmp agile_net behavioral2/memory/1668-378-0x0000025E81B20000-0x0000025E81D04000-memory.dmp agile_net behavioral2/memory/1668-380-0x0000025E81B20000-0x0000025E81D04000-memory.dmp agile_net behavioral2/memory/1668-382-0x0000025E81B20000-0x0000025E81D04000-memory.dmp agile_net behavioral2/memory/1668-384-0x0000025E81B20000-0x0000025E81D04000-memory.dmp agile_net behavioral2/memory/1668-386-0x0000025E81B20000-0x0000025E81D04000-memory.dmp agile_net behavioral2/memory/1668-388-0x0000025E81B20000-0x0000025E81D04000-memory.dmp agile_net behavioral2/memory/1668-390-0x0000025E81B20000-0x0000025E81D04000-memory.dmp agile_net behavioral2/memory/1668-392-0x0000025E81B20000-0x0000025E81D04000-memory.dmp agile_net behavioral2/memory/1668-394-0x0000025E81B20000-0x0000025E81D04000-memory.dmp agile_net behavioral2/memory/1668-396-0x0000025E81B20000-0x0000025E81D04000-memory.dmp agile_net behavioral2/memory/1668-398-0x0000025E81B20000-0x0000025E81D04000-memory.dmp agile_net behavioral2/memory/1668-400-0x0000025E81B20000-0x0000025E81D04000-memory.dmp agile_net behavioral2/memory/1668-402-0x0000025E81B20000-0x0000025E81D04000-memory.dmp agile_net behavioral2/memory/1668-404-0x0000025E81B20000-0x0000025E81D04000-memory.dmp agile_net behavioral2/memory/1668-406-0x0000025E81B20000-0x0000025E81D04000-memory.dmp agile_net behavioral2/memory/1668-408-0x0000025E81B20000-0x0000025E81D04000-memory.dmp agile_net behavioral2/memory/1668-410-0x0000025E81B20000-0x0000025E81D04000-memory.dmp agile_net behavioral2/memory/1668-412-0x0000025E81B20000-0x0000025E81D04000-memory.dmp agile_net behavioral2/memory/1668-414-0x0000025E81B20000-0x0000025E81D04000-memory.dmp agile_net behavioral2/memory/1668-416-0x0000025E81B20000-0x0000025E81D04000-memory.dmp agile_net behavioral2/memory/1668-418-0x0000025E81B20000-0x0000025E81D04000-memory.dmp agile_net behavioral2/memory/1668-420-0x0000025E81B20000-0x0000025E81D04000-memory.dmp agile_net behavioral2/memory/1668-422-0x0000025E81B20000-0x0000025E81D04000-memory.dmp agile_net behavioral2/memory/1668-424-0x0000025E81B20000-0x0000025E81D04000-memory.dmp agile_net behavioral2/memory/1668-426-0x0000025E81B20000-0x0000025E81D04000-memory.dmp agile_net behavioral2/memory/1668-428-0x0000025E81B20000-0x0000025E81D04000-memory.dmp agile_net behavioral2/memory/1668-430-0x0000025E81B20000-0x0000025E81D04000-memory.dmp agile_net behavioral2/memory/1668-432-0x0000025E81B20000-0x0000025E81D04000-memory.dmp agile_net behavioral2/memory/1668-434-0x0000025E81B20000-0x0000025E81D04000-memory.dmp agile_net -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Windows directory 3 IoCs
Processes:
Ambrosial.exedescription ioc process File created C:\Windows\Fonts\Azonix.otf Ambrosial.exe File opened for modification C:\Windows\Fonts\Azonix.otf Ambrosial.exe File created C:\Windows\Fonts\OpenSansLight.ttf Ambrosial.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Ambrosial.exedescription pid process Token: SeDebugPrivilege 1668 Ambrosial.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Ambrosial\assets\clients\1.16.220\Atani Classic\launcherAssets\ataniclassic.pngFilesize
44KB
MD5e5ef6bdf0c495893af82822f51711550
SHA1b09ad5ecaaed6af91dd24e031aaf8bceae1ae055
SHA2565a47fa7b19198bcad18091ae138a411b44faa2ddc2d9891650061cbdb63094da
SHA5123408ce2f0727e223f939b4d34fd9035083eddd7a0a8ace2a038d98d201dbeb1c48d1da0b5335d21dcdd8ddc726b5f117611247cfdacc9cd046d2c9dcde0cd492
-
C:\Users\Admin\AppData\Local\Ambrosial\assets\clients\1.17.201.0\Zephyr Classic\launcherAssets\yeeee.pngFilesize
115KB
MD557b901d65f2725d394d569c05dd34fa4
SHA1cdb25673ae31bc33872c39ec02924c33d42bba93
SHA256e6ce3cf2c8094af5e4e8e24b1283a8711dfd34dbb2d47b0f373ce7349dfb5998
SHA512bea29493c6b73d29e2e16f2f63fe49c9cf3d843156aca838f3d5e0f2e917050d4e79df3d44e09144e6a42f8c8a52bf4a0080f2dff6356fc04f8d469841a894b3
-
C:\Users\Admin\AppData\Local\Ambrosial\assets\clients\1.17.4006.0\Zephyr Classic\launcherAssets\zephyrNewB.pngFilesize
50KB
MD593a8e487ac8ce3f27b99b41dffc28551
SHA13ef1dec9d98dc84015fb0924df6398cb4df0de41
SHA2562a6157da3d3b511fcd05b67f6449c773663d3dc5b8328b808ccb2e4b4cf9f73b
SHA51218ba3eb47747ffae1afbf269b748fbbf4eaee6ce8d7c73b0c8410164ad8cbfac1af765e6f542ced635f2355773ee623f8b516ef6454fe1c363fe3e9ae3d2959e
-
C:\Users\Admin\AppData\Local\Ambrosial\assets\clients\1.19.3004.0\Zephyr Classic\launcherAssets\ProjectHalcyon.pngFilesize
54KB
MD5cf4b10cab822fb4e563d5c1fc7757a30
SHA157328884b3e1ebf4eaeb4715a33bf93a52c95d53
SHA256abb9e95c2b6bf7f7fad5f483b9e3e746bbca54a82ff79009d0760dcd2ff013cc
SHA512f0607ac012b3e86a56f63b9778bde661424e56b3b048f24c8d82b693fe673e860bf0225863f4f71915a1c8c5c83f3caa0de796a0059860d62e378e0b98135eb0
-
C:\Users\Admin\AppData\Local\Ambrosial\log.txtFilesize
3KB
MD5cb05c66baf64b4818a15aff6f1b2e15a
SHA177c9481bd0edfbe40ea99252c394e4ed63c4d772
SHA2562df7ad552c0e0e96d9eb2c4a84d26077198b5a81813b836bcde12c4dac38a770
SHA5127067ddeae31f491462fcfbcef799c69744d213768250051ca18f1bb019076128a43e9eadf5154c25100c0898785b2f4646439e769c4108d1713c4cc14b7cca56
-
C:\Users\Admin\AppData\Local\Ambrosial\log.txtFilesize
3KB
MD50cd7c03902fb17f58df76678e2cfc465
SHA1b286d9b21cdb4e0e47105b59d659885759a255ef
SHA2567385d396e036f0f44eb18234df5e595866ed9fdcceed4196af16181587addf95
SHA512329232e87280fdb1762be4c8b0e1ef562cf0ceee04d83f493eda6d434cc7afed6ccad92e6a26df540156914b5d7806ae021a0a59c16b6c2197fb59ade70a182c
-
C:\Users\Admin\AppData\Local\Ambrosial\log.txtFilesize
4KB
MD5734dd64e4bb6d870d9797a4e141a2ac2
SHA102cf110e1a76df05dab6c015cd8facf20444accd
SHA256ba6e40f98176a1ee314cd7cb102f10f1b194fa31b436a43c5a4763a355beddc9
SHA51265235dab5901182d864ab4cd7ab2394ec1e20f0338623eefb3ba069761aab3a595fc63baac8db40507bc28dc792691b7de9cdc45ae4835f9edc8b80b18a04d08
-
C:\Users\Admin\AppData\Local\Temp\0e1a63fc-9228-4b4f-96fc-fee060f96e92\GunaDotNetRT64.dllFilesize
142KB
MD59c43f77cb7cff27cb47ed67babe3eda5
SHA1b0400cf68249369d21de86bd26bb84ccffd47c43
SHA256f25b9288fe370dcfcb4823fb4e44ab88c7f5fce6e137d0dba389a3dba07d621e
SHA512cde6fb6cf8db6f9746e69e6c10214e60b3646700d70b49668a2a792e309714dd2d4c5a5241977a833a95fcde8318abcc89eb9968a5039a0b75726bbfa27125a7
-
C:\Users\Admin\AppData\Local\Temp\0e1a63fc-9228-4b4f-96fc-fee060f96e92\GunaDotNetRT64.dllFilesize
142KB
MD59c43f77cb7cff27cb47ed67babe3eda5
SHA1b0400cf68249369d21de86bd26bb84ccffd47c43
SHA256f25b9288fe370dcfcb4823fb4e44ab88c7f5fce6e137d0dba389a3dba07d621e
SHA512cde6fb6cf8db6f9746e69e6c10214e60b3646700d70b49668a2a792e309714dd2d4c5a5241977a833a95fcde8318abcc89eb9968a5039a0b75726bbfa27125a7
-
C:\Users\Admin\AppData\Local\Temp\Azonix.otfFilesize
11KB
MD5cdfe47b31e9184a55cf02eef1baf7240
SHA1b8825c605434d572f5277be0283d5a9b2cde59e4
SHA25651a65e5c09bf27980adf640cb54cb2a5bbb217fdaab79b377e158f92533362a9
SHA512a2e5141c0f7ca72bcf5b1a303fce1734953d83ad363d4c3c7d8786e1bfd872a6b96eeabce3740b547a5447e255415cdf688a0d2074cecfaa0c54c49d0f2882c5
-
C:\Windows\Fonts\OpenSansLight.ttfFilesize
217KB
MD51bf71be111189e76987a4bb9b3115cb7
SHA140442c189568184b6e6c27a25d69f14d91b65039
SHA256cf5f5184c1441a1660aa52526328e9d5c2793e77b6d8d3a3ad654bdb07ab8424
SHA512cb18b69e98a194af5e3e3d982a75254f3a20bd94c68816a15f38870b9be616cef0c32033f253219cca9146b2b419dd6df28cc4ceeff80d01f400aa0ed101e061
-
memory/1668-404-0x0000025E81B20000-0x0000025E81D04000-memory.dmpFilesize
1.9MB
-
memory/1668-416-0x0000025E81B20000-0x0000025E81D04000-memory.dmpFilesize
1.9MB
-
memory/1668-372-0x0000025E81B20000-0x0000025E81D04000-memory.dmpFilesize
1.9MB
-
memory/1668-373-0x0000025E81B20000-0x0000025E81D04000-memory.dmpFilesize
1.9MB
-
memory/1668-375-0x0000025E81B20000-0x0000025E81D04000-memory.dmpFilesize
1.9MB
-
memory/1668-377-0x00007FFACFC10000-0x00007FFACFC37000-memory.dmpFilesize
156KB
-
memory/1668-378-0x0000025E81B20000-0x0000025E81D04000-memory.dmpFilesize
1.9MB
-
memory/1668-380-0x0000025E81B20000-0x0000025E81D04000-memory.dmpFilesize
1.9MB
-
memory/1668-382-0x0000025E81B20000-0x0000025E81D04000-memory.dmpFilesize
1.9MB
-
memory/1668-384-0x0000025E81B20000-0x0000025E81D04000-memory.dmpFilesize
1.9MB
-
memory/1668-386-0x0000025E81B20000-0x0000025E81D04000-memory.dmpFilesize
1.9MB
-
memory/1668-388-0x0000025E81B20000-0x0000025E81D04000-memory.dmpFilesize
1.9MB
-
memory/1668-390-0x0000025E81B20000-0x0000025E81D04000-memory.dmpFilesize
1.9MB
-
memory/1668-392-0x0000025E81B20000-0x0000025E81D04000-memory.dmpFilesize
1.9MB
-
memory/1668-394-0x0000025E81B20000-0x0000025E81D04000-memory.dmpFilesize
1.9MB
-
memory/1668-396-0x0000025E81B20000-0x0000025E81D04000-memory.dmpFilesize
1.9MB
-
memory/1668-398-0x0000025E81B20000-0x0000025E81D04000-memory.dmpFilesize
1.9MB
-
memory/1668-400-0x0000025E81B20000-0x0000025E81D04000-memory.dmpFilesize
1.9MB
-
memory/1668-402-0x0000025E81B20000-0x0000025E81D04000-memory.dmpFilesize
1.9MB
-
memory/1668-164-0x0000025EE5950000-0x0000025EE5972000-memory.dmpFilesize
136KB
-
memory/1668-406-0x0000025E81B20000-0x0000025E81D04000-memory.dmpFilesize
1.9MB
-
memory/1668-408-0x0000025E81B20000-0x0000025E81D04000-memory.dmpFilesize
1.9MB
-
memory/1668-410-0x0000025E81B20000-0x0000025E81D04000-memory.dmpFilesize
1.9MB
-
memory/1668-412-0x0000025E81B20000-0x0000025E81D04000-memory.dmpFilesize
1.9MB
-
memory/1668-414-0x0000025E81B20000-0x0000025E81D04000-memory.dmpFilesize
1.9MB
-
memory/1668-371-0x00007FFAC6B00000-0x00007FFAC6C4E000-memory.dmpFilesize
1.3MB
-
memory/1668-418-0x0000025E81B20000-0x0000025E81D04000-memory.dmpFilesize
1.9MB
-
memory/1668-420-0x0000025E81B20000-0x0000025E81D04000-memory.dmpFilesize
1.9MB
-
memory/1668-422-0x0000025E81B20000-0x0000025E81D04000-memory.dmpFilesize
1.9MB
-
memory/1668-424-0x0000025E81B20000-0x0000025E81D04000-memory.dmpFilesize
1.9MB
-
memory/1668-426-0x0000025E81B20000-0x0000025E81D04000-memory.dmpFilesize
1.9MB
-
memory/1668-428-0x0000025E81B20000-0x0000025E81D04000-memory.dmpFilesize
1.9MB
-
memory/1668-430-0x0000025E81B20000-0x0000025E81D04000-memory.dmpFilesize
1.9MB
-
memory/1668-432-0x0000025E81B20000-0x0000025E81D04000-memory.dmpFilesize
1.9MB
-
memory/1668-434-0x0000025E81B20000-0x0000025E81D04000-memory.dmpFilesize
1.9MB
-
memory/1668-580-0x0000025EE7190000-0x0000025EE71A0000-memory.dmpFilesize
64KB
-
memory/1668-1305-0x00007FFACFC10000-0x00007FFACFC37000-memory.dmpFilesize
156KB
-
memory/1668-11677-0x0000025EE7190000-0x0000025EE71A0000-memory.dmpFilesize
64KB
-
memory/1668-11678-0x0000025EE7190000-0x0000025EE71A0000-memory.dmpFilesize
64KB
-
memory/1668-135-0x0000025EE58D0000-0x0000025EE58EA000-memory.dmpFilesize
104KB
-
memory/1668-134-0x0000025EE7190000-0x0000025EE71A0000-memory.dmpFilesize
64KB
-
memory/1668-133-0x0000025EE4580000-0x0000025EE556A000-memory.dmpFilesize
15.9MB
-
memory/1668-11804-0x0000025EE7190000-0x0000025EE71A0000-memory.dmpFilesize
64KB
-
memory/1668-11805-0x0000025EE7190000-0x0000025EE71A0000-memory.dmpFilesize
64KB
-
memory/1668-11806-0x0000025EE7190000-0x0000025EE71A0000-memory.dmpFilesize
64KB
-
memory/1668-11807-0x0000025EE7190000-0x0000025EE71A0000-memory.dmpFilesize
64KB
-
memory/1668-11808-0x0000025EE7190000-0x0000025EE71A0000-memory.dmpFilesize
64KB
-
memory/1668-11809-0x0000025EE7190000-0x0000025EE71A0000-memory.dmpFilesize
64KB
-
memory/1668-11810-0x0000025EE7190000-0x0000025EE71A0000-memory.dmpFilesize
64KB
-
memory/1668-11811-0x0000025EE7190000-0x0000025EE71A0000-memory.dmpFilesize
64KB