afa2f55e149097f9b250142bbfd94d9d56d10649c96adb079fdb0dfdac7c6660

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 03:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

afa2f55e149097f9b250142bbfd94d9d56d10649c96adb079fdb0dfdac7c6660.exe
Size

1.7MB
MD5

5214e287e7509bb4940901996b496d4d
SHA1

a3fe343817dc817c091fb2b30b36600abfb062df
SHA256

afa2f55e149097f9b250142bbfd94d9d56d10649c96adb079fdb0dfdac7c6660
SHA512

c29a538c58407e46d79df33d05014ea2156cf40dec11122569d9135adfe15f6b1a038bac4dc88a3ac8b2f2aae3cb72e22cf10cdacbe621dc8d3d60d57ef18797
SSDEEP

24576:QLBCNLuUJ8CMxio71kiSyvrZzUeQmu1+sbkGsN9zZ4uQMWsUbMjCfxXmikVgiK:Q94Lu1C6ryhwrFQmuXuFdHWjIjCgzVz

Score

9^/10

Malware Config

Signatures

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
behavioral1/memory/2196-0-0x0000000000370000-0x000000000052A000-memory.dmp	INDICATOR_EXE_Packed_Fody

Detects executables packed with Agile.NET / CliSecure 34 IoCs

resource	yara_rule
behavioral1/memory/2196-3-0x00000000051E0000-0x00000000053B8000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet
behavioral1/files/0x0009000000014b70-7.dat	INDICATOR_EXE_Packed_AgileDotNet
behavioral1/memory/2196-11-0x00000000051E0000-0x00000000053B3000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet
behavioral1/memory/2196-12-0x00000000051E0000-0x00000000053B3000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet
behavioral1/memory/2196-14-0x00000000051E0000-0x00000000053B3000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet
behavioral1/memory/2196-16-0x00000000051E0000-0x00000000053B3000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet
behavioral1/memory/2196-18-0x00000000051E0000-0x00000000053B3000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet
behavioral1/memory/2196-20-0x00000000051E0000-0x00000000053B3000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet
behavioral1/memory/2196-22-0x00000000051E0000-0x00000000053B3000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet
behavioral1/memory/2196-24-0x00000000051E0000-0x00000000053B3000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet
behavioral1/memory/2196-26-0x00000000051E0000-0x00000000053B3000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet
behavioral1/memory/2196-28-0x00000000051E0000-0x00000000053B3000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet
behavioral1/memory/2196-30-0x00000000051E0000-0x00000000053B3000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet
behavioral1/memory/2196-32-0x00000000051E0000-0x00000000053B3000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet
behavioral1/memory/2196-34-0x00000000051E0000-0x00000000053B3000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet
behavioral1/memory/2196-36-0x00000000051E0000-0x00000000053B3000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet
behavioral1/memory/2196-38-0x00000000051E0000-0x00000000053B3000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet
behavioral1/memory/2196-40-0x00000000051E0000-0x00000000053B3000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet
behavioral1/memory/2196-42-0x00000000051E0000-0x00000000053B3000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet
behavioral1/memory/2196-44-0x00000000051E0000-0x00000000053B3000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet
behavioral1/memory/2196-46-0x00000000051E0000-0x00000000053B3000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet
behavioral1/memory/2196-50-0x00000000051E0000-0x00000000053B3000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet
behavioral1/memory/2196-48-0x00000000051E0000-0x00000000053B3000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet
behavioral1/memory/2196-52-0x00000000051E0000-0x00000000053B3000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet
behavioral1/memory/2196-54-0x00000000051E0000-0x00000000053B3000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet
behavioral1/memory/2196-56-0x00000000051E0000-0x00000000053B3000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet
behavioral1/memory/2196-58-0x00000000051E0000-0x00000000053B3000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet
behavioral1/memory/2196-60-0x00000000051E0000-0x00000000053B3000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet
behavioral1/memory/2196-62-0x00000000051E0000-0x00000000053B3000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet
behavioral1/memory/2196-64-0x00000000051E0000-0x00000000053B3000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet
behavioral1/memory/2196-66-0x00000000051E0000-0x00000000053B3000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet
behavioral1/memory/2196-68-0x00000000051E0000-0x00000000053B3000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet
behavioral1/memory/2196-70-0x00000000051E0000-0x00000000053B3000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet
behavioral1/memory/2196-72-0x00000000051E0000-0x00000000053B3000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet

Loads dropped DLL 1 IoCs

pid	Process
2196	afa2f55e149097f9b250142bbfd94d9d56d10649c96adb079fdb0dfdac7c6660.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2196	afa2f55e149097f9b250142bbfd94d9d56d10649c96adb079fdb0dfdac7c6660.exe
2196	afa2f55e149097f9b250142bbfd94d9d56d10649c96adb079fdb0dfdac7c6660.exe

C:\Users\Admin\AppData\Local\Temp\afa2f55e149097f9b250142bbfd94d9d56d10649c96adb079fdb0dfdac7c6660.exe
"C:\Users\Admin\AppData\Local\Temp\afa2f55e149097f9b250142bbfd94d9d56d10649c96adb079fdb0dfdac7c6660.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\21130707-67bd-4fd2-91d2-b9f759127e7b\GunaUIDotNetRT.dll

Filesize
94KB

MD5
14ff402962ad21b78ae0b4c43cd1f194

SHA1
f8a510eb26666e875a5bdd1cadad40602763ad72

SHA256
fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

SHA512
daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

Download Submit
memory/2196-38-0x00000000051E0000-0x00000000053B3000-memory.dmp

Filesize
1.8MB

Download
memory/2196-42-0x00000000051E0000-0x00000000053B3000-memory.dmp

Filesize
1.8MB

Download
memory/2196-44-0x00000000051E0000-0x00000000053B3000-memory.dmp

Filesize
1.8MB

Download
memory/2196-0-0x0000000000370000-0x000000000052A000-memory.dmp

Filesize
1.7MB

Download
memory/2196-10-0x00000000747F0000-0x0000000074870000-memory.dmp

Filesize
512KB

Download
memory/2196-11-0x00000000051E0000-0x00000000053B3000-memory.dmp

Filesize
1.8MB

Download
memory/2196-12-0x00000000051E0000-0x00000000053B3000-memory.dmp

Filesize
1.8MB

Download
memory/2196-14-0x00000000051E0000-0x00000000053B3000-memory.dmp

Filesize
1.8MB

Download
memory/2196-16-0x00000000051E0000-0x00000000053B3000-memory.dmp

Filesize
1.8MB

Download
memory/2196-18-0x00000000051E0000-0x00000000053B3000-memory.dmp

Filesize
1.8MB

Download
memory/2196-20-0x00000000051E0000-0x00000000053B3000-memory.dmp

Filesize
1.8MB

Download
memory/2196-22-0x00000000051E0000-0x00000000053B3000-memory.dmp

Filesize
1.8MB

Download
memory/2196-24-0x00000000051E0000-0x00000000053B3000-memory.dmp

Filesize
1.8MB

Download
memory/2196-26-0x00000000051E0000-0x00000000053B3000-memory.dmp

Filesize
1.8MB

Download
memory/2196-28-0x00000000051E0000-0x00000000053B3000-memory.dmp

Filesize
1.8MB

Download
memory/2196-30-0x00000000051E0000-0x00000000053B3000-memory.dmp

Filesize
1.8MB

Download
memory/2196-32-0x00000000051E0000-0x00000000053B3000-memory.dmp

Filesize
1.8MB

Download
memory/2196-34-0x00000000051E0000-0x00000000053B3000-memory.dmp

Filesize
1.8MB

Download
memory/2196-36-0x00000000051E0000-0x00000000053B3000-memory.dmp

Filesize
1.8MB

Download
memory/2196-1-0x00000000749F0000-0x00000000750DE000-memory.dmp

Filesize
6.9MB

Download
memory/2196-2-0x0000000004C70000-0x0000000004CB0000-memory.dmp

Filesize
256KB

Download
memory/2196-40-0x00000000051E0000-0x00000000053B3000-memory.dmp

Filesize
1.8MB

Download
memory/2196-3-0x00000000051E0000-0x00000000053B8000-memory.dmp

Filesize
1.8MB

Download
memory/2196-46-0x00000000051E0000-0x00000000053B3000-memory.dmp

Filesize
1.8MB

Download
memory/2196-50-0x00000000051E0000-0x00000000053B3000-memory.dmp

Filesize
1.8MB

Download
memory/2196-48-0x00000000051E0000-0x00000000053B3000-memory.dmp

Filesize
1.8MB

Download
memory/2196-52-0x00000000051E0000-0x00000000053B3000-memory.dmp

Filesize
1.8MB

Download
memory/2196-54-0x00000000051E0000-0x00000000053B3000-memory.dmp

Filesize
1.8MB

Download
memory/2196-56-0x00000000051E0000-0x00000000053B3000-memory.dmp

Filesize
1.8MB

Download
memory/2196-58-0x00000000051E0000-0x00000000053B3000-memory.dmp

Filesize
1.8MB

Download
memory/2196-60-0x00000000051E0000-0x00000000053B3000-memory.dmp

Filesize
1.8MB

Download
memory/2196-62-0x00000000051E0000-0x00000000053B3000-memory.dmp

Filesize
1.8MB

Download
memory/2196-64-0x00000000051E0000-0x00000000053B3000-memory.dmp

Filesize
1.8MB

Download
memory/2196-66-0x00000000051E0000-0x00000000053B3000-memory.dmp

Filesize
1.8MB

Download
memory/2196-68-0x00000000051E0000-0x00000000053B3000-memory.dmp

Filesize
1.8MB

Download
memory/2196-70-0x00000000051E0000-0x00000000053B3000-memory.dmp

Filesize
1.8MB

Download
memory/2196-72-0x00000000051E0000-0x00000000053B3000-memory.dmp

Filesize
1.8MB

Download
memory/2196-3485-0x00000000749F0000-0x00000000750DE000-memory.dmp

Filesize
6.9MB

Download
memory/2196-4418-0x0000000004C70000-0x0000000004CB0000-memory.dmp

Filesize
256KB

Download
memory/2196-11745-0x0000000004C70000-0x0000000004CB0000-memory.dmp

Filesize
256KB

Download
memory/2196-11746-0x0000000004C70000-0x0000000004CB0000-memory.dmp

Filesize
256KB

Download
memory/2196-11747-0x0000000004C70000-0x0000000004CB0000-memory.dmp

Filesize
256KB

Download