Analysis
-
max time kernel
65s -
max time network
64s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
02-05-2023 15:22
Static task
static1
Behavioral task
behavioral1
Sample
Ambrosial.exe
Resource
win10-20230220-en
General
-
Target
Ambrosial.exe
-
Size
15.9MB
-
MD5
596b0f4684d45de83c204967c06e48a3
-
SHA1
933dc2dc29a17a9447c944289fed4f98e0eb5e5f
-
SHA256
6ff53b8187d0d3e287ad9ce3da20eca4f9dd105a2e3421ca1ad73b533ec4b91a
-
SHA512
8f50098d120d32a84347a8337dee27061a6914d66b951f930d491a81a9804317318f25f80467684fd4fecea6bccc6de38b2df3ee2742a54805f2cdb4413d3830
-
SSDEEP
196608:64WxsIO2gfRMhSE8/Erd8QP+ih91qBpodTAIRq+2vBt:64WuIO2gfRMYbcr6QP391qBafC
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
Ambrosial.exepid process 2436 Ambrosial.exe -
Obfuscated with Agile.Net obfuscator 33 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/2436-353-0x000002B1AC550000-0x000002B1AC738000-memory.dmp agile_net behavioral1/memory/2436-361-0x000002B1AC550000-0x000002B1AC734000-memory.dmp agile_net behavioral1/memory/2436-362-0x000002B1AC550000-0x000002B1AC734000-memory.dmp agile_net behavioral1/memory/2436-364-0x000002B1AC550000-0x000002B1AC734000-memory.dmp agile_net behavioral1/memory/2436-366-0x000002B1AC550000-0x000002B1AC734000-memory.dmp agile_net behavioral1/memory/2436-369-0x000002B1AC550000-0x000002B1AC734000-memory.dmp agile_net behavioral1/memory/2436-371-0x000002B1AC550000-0x000002B1AC734000-memory.dmp agile_net behavioral1/memory/2436-373-0x000002B1AC550000-0x000002B1AC734000-memory.dmp agile_net behavioral1/memory/2436-375-0x000002B1AC550000-0x000002B1AC734000-memory.dmp agile_net behavioral1/memory/2436-377-0x000002B1AC550000-0x000002B1AC734000-memory.dmp agile_net behavioral1/memory/2436-379-0x000002B1AC550000-0x000002B1AC734000-memory.dmp agile_net behavioral1/memory/2436-381-0x000002B1AC550000-0x000002B1AC734000-memory.dmp agile_net behavioral1/memory/2436-383-0x000002B1AC550000-0x000002B1AC734000-memory.dmp agile_net behavioral1/memory/2436-385-0x000002B1AC550000-0x000002B1AC734000-memory.dmp agile_net behavioral1/memory/2436-387-0x000002B1AC550000-0x000002B1AC734000-memory.dmp agile_net behavioral1/memory/2436-389-0x000002B1AC550000-0x000002B1AC734000-memory.dmp agile_net behavioral1/memory/2436-391-0x000002B1AC550000-0x000002B1AC734000-memory.dmp agile_net behavioral1/memory/2436-393-0x000002B1AC550000-0x000002B1AC734000-memory.dmp agile_net behavioral1/memory/2436-395-0x000002B1AC550000-0x000002B1AC734000-memory.dmp agile_net behavioral1/memory/2436-397-0x000002B1AC550000-0x000002B1AC734000-memory.dmp agile_net behavioral1/memory/2436-399-0x000002B1AC550000-0x000002B1AC734000-memory.dmp agile_net behavioral1/memory/2436-401-0x000002B1AC550000-0x000002B1AC734000-memory.dmp agile_net behavioral1/memory/2436-403-0x000002B1AC550000-0x000002B1AC734000-memory.dmp agile_net behavioral1/memory/2436-405-0x000002B1AC550000-0x000002B1AC734000-memory.dmp agile_net behavioral1/memory/2436-407-0x000002B1AC550000-0x000002B1AC734000-memory.dmp agile_net behavioral1/memory/2436-409-0x000002B1AC550000-0x000002B1AC734000-memory.dmp agile_net behavioral1/memory/2436-411-0x000002B1AC550000-0x000002B1AC734000-memory.dmp agile_net behavioral1/memory/2436-413-0x000002B1AC550000-0x000002B1AC734000-memory.dmp agile_net behavioral1/memory/2436-415-0x000002B1AC550000-0x000002B1AC734000-memory.dmp agile_net behavioral1/memory/2436-417-0x000002B1AC550000-0x000002B1AC734000-memory.dmp agile_net behavioral1/memory/2436-419-0x000002B1AC550000-0x000002B1AC734000-memory.dmp agile_net behavioral1/memory/2436-421-0x000002B1AC550000-0x000002B1AC734000-memory.dmp agile_net behavioral1/memory/2436-423-0x000002B1AC550000-0x000002B1AC734000-memory.dmp agile_net -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Windows directory 3 IoCs
Processes:
Ambrosial.exedescription ioc process File created C:\Windows\Fonts\Azonix.otf Ambrosial.exe File opened for modification C:\Windows\Fonts\Azonix.otf Ambrosial.exe File created C:\Windows\Fonts\OpenSansLight.ttf Ambrosial.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Ambrosial.exedescription pid process Token: SeDebugPrivilege 2436 Ambrosial.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe"C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2436
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2580
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Ambrosial\assets\clients\1.19.3004.0\Zephyr Classic\launcherAssets\ProjectHalcyon.pngFilesize
54KB
MD5cf4b10cab822fb4e563d5c1fc7757a30
SHA157328884b3e1ebf4eaeb4715a33bf93a52c95d53
SHA256abb9e95c2b6bf7f7fad5f483b9e3e746bbca54a82ff79009d0760dcd2ff013cc
SHA512f0607ac012b3e86a56f63b9778bde661424e56b3b048f24c8d82b693fe673e860bf0225863f4f71915a1c8c5c83f3caa0de796a0059860d62e378e0b98135eb0
-
C:\Users\Admin\AppData\Local\Ambrosial\log.txtFilesize
4KB
MD5f2e04c9c1396bc978c00e07023eb038c
SHA192e667597a9d69032e323e4906dc710ef7730808
SHA25666db7e83a35f1f19a3cde54cbfc62e59ccf663648a27cd8681bf9f4e2ddbcb8e
SHA512fb5abc4d50ce9c80a4343eb17ad65e4b3d34acbbdde4ce4e917f360e169da7139f946dca8a09b422e91aacd43d9619d4f2f546228ebfd3f209309ad98ad69f2c
-
C:\Users\Admin\AppData\Local\Temp\0e1a63fc-9228-4b4f-96fc-fee060f96e92\GunaDotNetRT64.dllFilesize
142KB
MD59c43f77cb7cff27cb47ed67babe3eda5
SHA1b0400cf68249369d21de86bd26bb84ccffd47c43
SHA256f25b9288fe370dcfcb4823fb4e44ab88c7f5fce6e137d0dba389a3dba07d621e
SHA512cde6fb6cf8db6f9746e69e6c10214e60b3646700d70b49668a2a792e309714dd2d4c5a5241977a833a95fcde8318abcc89eb9968a5039a0b75726bbfa27125a7
-
C:\Users\Admin\AppData\Local\Temp\Azonix.otfFilesize
11KB
MD5cdfe47b31e9184a55cf02eef1baf7240
SHA1b8825c605434d572f5277be0283d5a9b2cde59e4
SHA25651a65e5c09bf27980adf640cb54cb2a5bbb217fdaab79b377e158f92533362a9
SHA512a2e5141c0f7ca72bcf5b1a303fce1734953d83ad363d4c3c7d8786e1bfd872a6b96eeabce3740b547a5447e255415cdf688a0d2074cecfaa0c54c49d0f2882c5
-
C:\Windows\Fonts\OpenSansLight.ttfFilesize
217KB
MD51bf71be111189e76987a4bb9b3115cb7
SHA140442c189568184b6e6c27a25d69f14d91b65039
SHA256cf5f5184c1441a1660aa52526328e9d5c2793e77b6d8d3a3ad654bdb07ab8424
SHA512cb18b69e98a194af5e3e3d982a75254f3a20bd94c68816a15f38870b9be616cef0c32033f253219cca9146b2b419dd6df28cc4ceeff80d01f400aa0ed101e061
-
\Users\Admin\AppData\Local\Temp\0e1a63fc-9228-4b4f-96fc-fee060f96e92\GunaDotNetRT64.dllFilesize
142KB
MD59c43f77cb7cff27cb47ed67babe3eda5
SHA1b0400cf68249369d21de86bd26bb84ccffd47c43
SHA256f25b9288fe370dcfcb4823fb4e44ab88c7f5fce6e137d0dba389a3dba07d621e
SHA512cde6fb6cf8db6f9746e69e6c10214e60b3646700d70b49668a2a792e309714dd2d4c5a5241977a833a95fcde8318abcc89eb9968a5039a0b75726bbfa27125a7
-
memory/2436-379-0x000002B1AC550000-0x000002B1AC734000-memory.dmpFilesize
1.9MB
-
memory/2436-385-0x000002B1AC550000-0x000002B1AC734000-memory.dmpFilesize
1.9MB
-
memory/2436-145-0x000002B1ABAB0000-0x000002B1ABB60000-memory.dmpFilesize
704KB
-
memory/2436-124-0x000002B193280000-0x000002B19329A000-memory.dmpFilesize
104KB
-
memory/2436-353-0x000002B1AC550000-0x000002B1AC738000-memory.dmpFilesize
1.9MB
-
memory/2436-123-0x000002B1ABBA0000-0x000002B1ABBB0000-memory.dmpFilesize
64KB
-
memory/2436-122-0x000002B193240000-0x000002B19325C000-memory.dmpFilesize
112KB
-
memory/2436-360-0x00007FFF8FD50000-0x00007FFF8FE7C000-memory.dmpFilesize
1.2MB
-
memory/2436-361-0x000002B1AC550000-0x000002B1AC734000-memory.dmpFilesize
1.9MB
-
memory/2436-362-0x000002B1AC550000-0x000002B1AC734000-memory.dmpFilesize
1.9MB
-
memory/2436-364-0x000002B1AC550000-0x000002B1AC734000-memory.dmpFilesize
1.9MB
-
memory/2436-366-0x000002B1AC550000-0x000002B1AC734000-memory.dmpFilesize
1.9MB
-
memory/2436-369-0x000002B1AC550000-0x000002B1AC734000-memory.dmpFilesize
1.9MB
-
memory/2436-368-0x00007FFF8FD20000-0x00007FFF8FD47000-memory.dmpFilesize
156KB
-
memory/2436-371-0x000002B1AC550000-0x000002B1AC734000-memory.dmpFilesize
1.9MB
-
memory/2436-373-0x000002B1AC550000-0x000002B1AC734000-memory.dmpFilesize
1.9MB
-
memory/2436-375-0x000002B1AC550000-0x000002B1AC734000-memory.dmpFilesize
1.9MB
-
memory/2436-377-0x000002B1AC550000-0x000002B1AC734000-memory.dmpFilesize
1.9MB
-
memory/2436-121-0x000002B190710000-0x000002B1916FA000-memory.dmpFilesize
15.9MB
-
memory/2436-381-0x000002B1AC550000-0x000002B1AC734000-memory.dmpFilesize
1.9MB
-
memory/2436-383-0x000002B1AC550000-0x000002B1AC734000-memory.dmpFilesize
1.9MB
-
memory/2436-152-0x000002B1AC340000-0x000002B1AC362000-memory.dmpFilesize
136KB
-
memory/2436-387-0x000002B1AC550000-0x000002B1AC734000-memory.dmpFilesize
1.9MB
-
memory/2436-389-0x000002B1AC550000-0x000002B1AC734000-memory.dmpFilesize
1.9MB
-
memory/2436-391-0x000002B1AC550000-0x000002B1AC734000-memory.dmpFilesize
1.9MB
-
memory/2436-393-0x000002B1AC550000-0x000002B1AC734000-memory.dmpFilesize
1.9MB
-
memory/2436-395-0x000002B1AC550000-0x000002B1AC734000-memory.dmpFilesize
1.9MB
-
memory/2436-397-0x000002B1AC550000-0x000002B1AC734000-memory.dmpFilesize
1.9MB
-
memory/2436-399-0x000002B1AC550000-0x000002B1AC734000-memory.dmpFilesize
1.9MB
-
memory/2436-401-0x000002B1AC550000-0x000002B1AC734000-memory.dmpFilesize
1.9MB
-
memory/2436-403-0x000002B1AC550000-0x000002B1AC734000-memory.dmpFilesize
1.9MB
-
memory/2436-405-0x000002B1AC550000-0x000002B1AC734000-memory.dmpFilesize
1.9MB
-
memory/2436-407-0x000002B1AC550000-0x000002B1AC734000-memory.dmpFilesize
1.9MB
-
memory/2436-409-0x000002B1AC550000-0x000002B1AC734000-memory.dmpFilesize
1.9MB
-
memory/2436-411-0x000002B1AC550000-0x000002B1AC734000-memory.dmpFilesize
1.9MB
-
memory/2436-413-0x000002B1AC550000-0x000002B1AC734000-memory.dmpFilesize
1.9MB
-
memory/2436-415-0x000002B1AC550000-0x000002B1AC734000-memory.dmpFilesize
1.9MB
-
memory/2436-417-0x000002B1AC550000-0x000002B1AC734000-memory.dmpFilesize
1.9MB
-
memory/2436-419-0x000002B1AC550000-0x000002B1AC734000-memory.dmpFilesize
1.9MB
-
memory/2436-421-0x000002B1AC550000-0x000002B1AC734000-memory.dmpFilesize
1.9MB
-
memory/2436-423-0x000002B1AC550000-0x000002B1AC734000-memory.dmpFilesize
1.9MB
-
memory/2436-521-0x000002B1ABBA0000-0x000002B1ABBB0000-memory.dmpFilesize
64KB
-
memory/2436-843-0x00007FFF8FD20000-0x00007FFF8FD47000-memory.dmpFilesize
156KB