Analysis

  • max time kernel
    120s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    14/10/2023, 01:48

General

  • Target

    Universal Project/bin/Debug/Universal Project.exe

  • Size

    848KB

  • MD5

    1d0249175ad0d5ef7b45abda9217d985

  • SHA1

    774e22b0b759f2295b928e7ddd80d72d5b3d7033

  • SHA256

    c8257e7c100f75ba982e3505efc19c25c04ddbc9d0059aef36075d569d51fea4

  • SHA512

    9ae8cda66af681a7829b91eea8ca79209ebb2ae385464e97f6839ea1cd636c47e7d3441b0e56346c7b2cbcab929756cfef464a41d3600f4eeb1a8aadc6574ffb

  • SSDEEP

    12288:WcHqbvW+vWBXbQSCaFpxXLXHwQRv1XEW+vDYP35Wl8Cgw9EnQGW+3:96vW+vWFx3XDHJ0W+vDYBWlnXcQGW+3

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Universal Project\bin\Debug\Universal Project.exe
    "C:\Users\Admin\AppData\Local\Temp\Universal Project\bin\Debug\Universal Project.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:2560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\53b4dde3-ceef-4149-b63d-4b67cc36c3e9\GunaDotNetRT.dll

    Filesize

    136KB

    MD5

    9af5eb006bb0bab7f226272d82c896c7

    SHA1

    c2a5bb42a5f08f4dc821be374b700652262308f0

    SHA256

    77dc05a6bda90757f66552ee3f469b09f1e00732b4edca0f542872fb591ed9db

    SHA512

    7badd41be4c1039302fda9bba19d374ec9446ce24b7db33b66bee4ef38180d1abcd666d2aea468e7e452aa1e1565eedfefed582bf1c2fe477a4171d99d48772a

  • \Users\Admin\AppData\Local\Temp\53b4dde3-ceef-4149-b63d-4b67cc36c3e9\GunaDotNetRT.dll

    Filesize

    136KB

    MD5

    9af5eb006bb0bab7f226272d82c896c7

    SHA1

    c2a5bb42a5f08f4dc821be374b700652262308f0

    SHA256

    77dc05a6bda90757f66552ee3f469b09f1e00732b4edca0f542872fb591ed9db

    SHA512

    7badd41be4c1039302fda9bba19d374ec9446ce24b7db33b66bee4ef38180d1abcd666d2aea468e7e452aa1e1565eedfefed582bf1c2fe477a4171d99d48772a

  • memory/2560-12-0x00000000049D0000-0x0000000004A10000-memory.dmp

    Filesize

    256KB

  • memory/2560-13-0x0000000005E10000-0x0000000005F2A000-memory.dmp

    Filesize

    1.1MB

  • memory/2560-2-0x00000000049D0000-0x0000000004A10000-memory.dmp

    Filesize

    256KB

  • memory/2560-11-0x00000000738D0000-0x0000000073950000-memory.dmp

    Filesize

    512KB

  • memory/2560-10-0x000000006FD80000-0x000000006FDB7000-memory.dmp

    Filesize

    220KB

  • memory/2560-1-0x00000000744A0000-0x0000000074B8E000-memory.dmp

    Filesize

    6.9MB

  • memory/2560-0-0x00000000013D0000-0x00000000014A8000-memory.dmp

    Filesize

    864KB

  • memory/2560-3-0x0000000004EF0000-0x000000000513C000-memory.dmp

    Filesize

    2.3MB

  • memory/2560-14-0x0000000001350000-0x00000000013B6000-memory.dmp

    Filesize

    408KB

  • memory/2560-15-0x00000000049D0000-0x0000000004A10000-memory.dmp

    Filesize

    256KB

  • memory/2560-16-0x00000000744A0000-0x0000000074B8E000-memory.dmp

    Filesize

    6.9MB

  • memory/2560-17-0x00000000049D0000-0x0000000004A10000-memory.dmp

    Filesize

    256KB

  • memory/2560-18-0x000000006FD80000-0x000000006FDB7000-memory.dmp

    Filesize

    220KB

  • memory/2560-19-0x00000000049D0000-0x0000000004A10000-memory.dmp

    Filesize

    256KB