Analysis
-
max time kernel
136s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
16/07/2023, 14:30
Static task
static1
Behavioral task
behavioral1
Sample
Luxury Crypter.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Luxury Crypter.exe
Resource
win10v2004-20230703-en
General
-
Target
Luxury Crypter.exe
-
Size
17.0MB
-
MD5
fc8908c929a551bdd3ed232485b319f9
-
SHA1
e2e51f5029d700296ec6652221d83b26b0b700f4
-
SHA256
fb1121c26cbe32dc1af83a2b11ca4781a1d76e0d8ac7f76795f43cec3d4063bb
-
SHA512
1ecf400f5f5dd5521406c65d714214d4e8e544256bdf8304be3d6448670df87945cebb1646aa9d6e4a88b9d0b15bbf771514f4948ea68d223104d06368045bfe
-
SSDEEP
393216:qweOmsYH1RLyK/FVLYhgNKJujXjyUd12ct/ErCPqcSSXzwoHs4ZIoYcyty:QjsYHfyWFVLqgN3jXjWoLZIzy
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1648 Luxury Crypter.exe -
Obfuscated with Agile.Net obfuscator 33 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule behavioral1/memory/1648-58-0x0000000005F00000-0x000000000614C000-memory.dmp agile_net behavioral1/memory/1648-69-0x0000000005F00000-0x0000000006148000-memory.dmp agile_net behavioral1/memory/1648-70-0x0000000005F00000-0x0000000006148000-memory.dmp agile_net behavioral1/memory/1648-72-0x0000000005F00000-0x0000000006148000-memory.dmp agile_net behavioral1/memory/1648-74-0x0000000005F00000-0x0000000006148000-memory.dmp agile_net behavioral1/memory/1648-76-0x0000000005F00000-0x0000000006148000-memory.dmp agile_net behavioral1/memory/1648-78-0x0000000005F00000-0x0000000006148000-memory.dmp agile_net behavioral1/memory/1648-80-0x0000000005F00000-0x0000000006148000-memory.dmp agile_net behavioral1/memory/1648-84-0x0000000005F00000-0x0000000006148000-memory.dmp agile_net behavioral1/memory/1648-82-0x0000000005F00000-0x0000000006148000-memory.dmp agile_net behavioral1/memory/1648-86-0x0000000005F00000-0x0000000006148000-memory.dmp agile_net behavioral1/memory/1648-90-0x0000000005F00000-0x0000000006148000-memory.dmp agile_net behavioral1/memory/1648-88-0x0000000005F00000-0x0000000006148000-memory.dmp agile_net behavioral1/memory/1648-130-0x0000000005F00000-0x0000000006148000-memory.dmp agile_net behavioral1/memory/1648-128-0x0000000005F00000-0x0000000006148000-memory.dmp agile_net behavioral1/memory/1648-126-0x0000000005F00000-0x0000000006148000-memory.dmp agile_net behavioral1/memory/1648-124-0x0000000005F00000-0x0000000006148000-memory.dmp agile_net behavioral1/memory/1648-122-0x0000000005F00000-0x0000000006148000-memory.dmp agile_net behavioral1/memory/1648-120-0x0000000005F00000-0x0000000006148000-memory.dmp agile_net behavioral1/memory/1648-118-0x0000000005F00000-0x0000000006148000-memory.dmp agile_net behavioral1/memory/1648-116-0x0000000005F00000-0x0000000006148000-memory.dmp agile_net behavioral1/memory/1648-114-0x0000000005F00000-0x0000000006148000-memory.dmp agile_net behavioral1/memory/1648-112-0x0000000005F00000-0x0000000006148000-memory.dmp agile_net behavioral1/memory/1648-110-0x0000000005F00000-0x0000000006148000-memory.dmp agile_net behavioral1/memory/1648-108-0x0000000005F00000-0x0000000006148000-memory.dmp agile_net behavioral1/memory/1648-106-0x0000000005F00000-0x0000000006148000-memory.dmp agile_net behavioral1/memory/1648-104-0x0000000005F00000-0x0000000006148000-memory.dmp agile_net behavioral1/memory/1648-102-0x0000000005F00000-0x0000000006148000-memory.dmp agile_net behavioral1/memory/1648-100-0x0000000005F00000-0x0000000006148000-memory.dmp agile_net behavioral1/memory/1648-98-0x0000000005F00000-0x0000000006148000-memory.dmp agile_net behavioral1/memory/1648-96-0x0000000005F00000-0x0000000006148000-memory.dmp agile_net behavioral1/memory/1648-94-0x0000000005F00000-0x0000000006148000-memory.dmp agile_net behavioral1/memory/1648-92-0x0000000005F00000-0x0000000006148000-memory.dmp agile_net -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1648 Luxury Crypter.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1648 Luxury Crypter.exe 1648 Luxury Crypter.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD59af5eb006bb0bab7f226272d82c896c7
SHA1c2a5bb42a5f08f4dc821be374b700652262308f0
SHA25677dc05a6bda90757f66552ee3f469b09f1e00732b4edca0f542872fb591ed9db
SHA5127badd41be4c1039302fda9bba19d374ec9446ce24b7db33b66bee4ef38180d1abcd666d2aea468e7e452aa1e1565eedfefed582bf1c2fe477a4171d99d48772a
-
Filesize
136KB
MD59af5eb006bb0bab7f226272d82c896c7
SHA1c2a5bb42a5f08f4dc821be374b700652262308f0
SHA25677dc05a6bda90757f66552ee3f469b09f1e00732b4edca0f542872fb591ed9db
SHA5127badd41be4c1039302fda9bba19d374ec9446ce24b7db33b66bee4ef38180d1abcd666d2aea468e7e452aa1e1565eedfefed582bf1c2fe477a4171d99d48772a