Analysis

  • max time kernel
    136s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    16/07/2023, 14:30

General

  • Target

    Luxury Crypter.exe

  • Size

    17.0MB

  • MD5

    fc8908c929a551bdd3ed232485b319f9

  • SHA1

    e2e51f5029d700296ec6652221d83b26b0b700f4

  • SHA256

    fb1121c26cbe32dc1af83a2b11ca4781a1d76e0d8ac7f76795f43cec3d4063bb

  • SHA512

    1ecf400f5f5dd5521406c65d714214d4e8e544256bdf8304be3d6448670df87945cebb1646aa9d6e4a88b9d0b15bbf771514f4948ea68d223104d06368045bfe

  • SSDEEP

    393216:qweOmsYH1RLyK/FVLYhgNKJujXjyUd12ct/ErCPqcSSXzwoHs4ZIoYcyty:QjsYHfyWFVLqgN3jXjWoLZIzy

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Obfuscated with Agile.Net obfuscator 33 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Luxury Crypter.exe
    "C:\Users\Admin\AppData\Local\Temp\Luxury Crypter.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1648

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\53b4dde3-ceef-4149-b63d-4b67cc36c3e9\GunaDotNetRT.dll

          Filesize

          136KB

          MD5

          9af5eb006bb0bab7f226272d82c896c7

          SHA1

          c2a5bb42a5f08f4dc821be374b700652262308f0

          SHA256

          77dc05a6bda90757f66552ee3f469b09f1e00732b4edca0f542872fb591ed9db

          SHA512

          7badd41be4c1039302fda9bba19d374ec9446ce24b7db33b66bee4ef38180d1abcd666d2aea468e7e452aa1e1565eedfefed582bf1c2fe477a4171d99d48772a

        • \Users\Admin\AppData\Local\Temp\53b4dde3-ceef-4149-b63d-4b67cc36c3e9\GunaDotNetRT.dll

          Filesize

          136KB

          MD5

          9af5eb006bb0bab7f226272d82c896c7

          SHA1

          c2a5bb42a5f08f4dc821be374b700652262308f0

          SHA256

          77dc05a6bda90757f66552ee3f469b09f1e00732b4edca0f542872fb591ed9db

          SHA512

          7badd41be4c1039302fda9bba19d374ec9446ce24b7db33b66bee4ef38180d1abcd666d2aea468e7e452aa1e1565eedfefed582bf1c2fe477a4171d99d48772a

        • memory/1648-54-0x0000000074340000-0x0000000074A2E000-memory.dmp

          Filesize

          6.9MB

        • memory/1648-55-0x0000000001120000-0x000000000222A000-memory.dmp

          Filesize

          17.0MB

        • memory/1648-56-0x0000000000CA0000-0x0000000000CE0000-memory.dmp

          Filesize

          256KB

        • memory/1648-57-0x0000000007F00000-0x0000000008F3A000-memory.dmp

          Filesize

          16.2MB

        • memory/1648-58-0x0000000005F00000-0x000000000614C000-memory.dmp

          Filesize

          2.3MB

        • memory/1648-59-0x0000000005D70000-0x0000000005E8A000-memory.dmp

          Filesize

          1.1MB

        • memory/1648-60-0x0000000000240000-0x00000000002A2000-memory.dmp

          Filesize

          392KB

        • memory/1648-67-0x0000000073A30000-0x0000000073A67000-memory.dmp

          Filesize

          220KB

        • memory/1648-69-0x0000000005F00000-0x0000000006148000-memory.dmp

          Filesize

          2.3MB

        • memory/1648-70-0x0000000005F00000-0x0000000006148000-memory.dmp

          Filesize

          2.3MB

        • memory/1648-68-0x0000000074130000-0x00000000741B0000-memory.dmp

          Filesize

          512KB

        • memory/1648-72-0x0000000005F00000-0x0000000006148000-memory.dmp

          Filesize

          2.3MB

        • memory/1648-74-0x0000000005F00000-0x0000000006148000-memory.dmp

          Filesize

          2.3MB

        • memory/1648-76-0x0000000005F00000-0x0000000006148000-memory.dmp

          Filesize

          2.3MB

        • memory/1648-78-0x0000000005F00000-0x0000000006148000-memory.dmp

          Filesize

          2.3MB

        • memory/1648-80-0x0000000005F00000-0x0000000006148000-memory.dmp

          Filesize

          2.3MB

        • memory/1648-84-0x0000000005F00000-0x0000000006148000-memory.dmp

          Filesize

          2.3MB

        • memory/1648-82-0x0000000005F00000-0x0000000006148000-memory.dmp

          Filesize

          2.3MB

        • memory/1648-86-0x0000000005F00000-0x0000000006148000-memory.dmp

          Filesize

          2.3MB

        • memory/1648-90-0x0000000005F00000-0x0000000006148000-memory.dmp

          Filesize

          2.3MB

        • memory/1648-88-0x0000000005F00000-0x0000000006148000-memory.dmp

          Filesize

          2.3MB

        • memory/1648-130-0x0000000005F00000-0x0000000006148000-memory.dmp

          Filesize

          2.3MB

        • memory/1648-128-0x0000000005F00000-0x0000000006148000-memory.dmp

          Filesize

          2.3MB

        • memory/1648-126-0x0000000005F00000-0x0000000006148000-memory.dmp

          Filesize

          2.3MB

        • memory/1648-124-0x0000000005F00000-0x0000000006148000-memory.dmp

          Filesize

          2.3MB

        • memory/1648-122-0x0000000005F00000-0x0000000006148000-memory.dmp

          Filesize

          2.3MB

        • memory/1648-120-0x0000000005F00000-0x0000000006148000-memory.dmp

          Filesize

          2.3MB

        • memory/1648-118-0x0000000005F00000-0x0000000006148000-memory.dmp

          Filesize

          2.3MB

        • memory/1648-116-0x0000000005F00000-0x0000000006148000-memory.dmp

          Filesize

          2.3MB

        • memory/1648-114-0x0000000005F00000-0x0000000006148000-memory.dmp

          Filesize

          2.3MB

        • memory/1648-112-0x0000000005F00000-0x0000000006148000-memory.dmp

          Filesize

          2.3MB

        • memory/1648-110-0x0000000005F00000-0x0000000006148000-memory.dmp

          Filesize

          2.3MB

        • memory/1648-108-0x0000000005F00000-0x0000000006148000-memory.dmp

          Filesize

          2.3MB

        • memory/1648-106-0x0000000005F00000-0x0000000006148000-memory.dmp

          Filesize

          2.3MB

        • memory/1648-104-0x0000000005F00000-0x0000000006148000-memory.dmp

          Filesize

          2.3MB

        • memory/1648-102-0x0000000005F00000-0x0000000006148000-memory.dmp

          Filesize

          2.3MB

        • memory/1648-100-0x0000000005F00000-0x0000000006148000-memory.dmp

          Filesize

          2.3MB

        • memory/1648-98-0x0000000005F00000-0x0000000006148000-memory.dmp

          Filesize

          2.3MB

        • memory/1648-96-0x0000000005F00000-0x0000000006148000-memory.dmp

          Filesize

          2.3MB

        • memory/1648-94-0x0000000005F00000-0x0000000006148000-memory.dmp

          Filesize

          2.3MB

        • memory/1648-92-0x0000000005F00000-0x0000000006148000-memory.dmp

          Filesize

          2.3MB

        • memory/1648-528-0x0000000074340000-0x0000000074A2E000-memory.dmp

          Filesize

          6.9MB

        • memory/1648-698-0x0000000000CA0000-0x0000000000CE0000-memory.dmp

          Filesize

          256KB

        • memory/1648-882-0x0000000073A30000-0x0000000073A67000-memory.dmp

          Filesize

          220KB

        • memory/1648-10668-0x0000000005900000-0x0000000005966000-memory.dmp

          Filesize

          408KB

        • memory/1648-10669-0x0000000000CA0000-0x0000000000CE0000-memory.dmp

          Filesize

          256KB

        • memory/1648-10670-0x0000000000CA0000-0x0000000000CE0000-memory.dmp

          Filesize

          256KB

        • memory/1648-10671-0x0000000001110000-0x000000000111A000-memory.dmp

          Filesize

          40KB

        • memory/1648-10672-0x0000000006E10000-0x0000000006E36000-memory.dmp

          Filesize

          152KB

        • memory/1648-10674-0x0000000000CA0000-0x0000000000CE0000-memory.dmp

          Filesize

          256KB