Analysis

  • max time kernel
    120s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    04-03-2024 02:40

General

  • Target

    b10436ebe8849d347c9e82c25b118bc6.exe

  • Size

    228KB

  • MD5

    b10436ebe8849d347c9e82c25b118bc6

  • SHA1

    2a95655895679de2f45600d2dde6ec78c112eaa0

  • SHA256

    7c78f6c7c4f21544b4958eb35cbd32b82b524d931af2caba7632fa8c6dd07209

  • SHA512

    12226f20d532df3ef08e26c1fa9d847137017783bae1e0f15673aa5878333263eef3e132357fe6baabe0826598a9fd43e79f60445e1593154e7d423263253223

  • SSDEEP

    6144:VUVevCzfet3Agp0q9ygbX+1RzDU884gN:CevCzsaMJcR/V84+

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b10436ebe8849d347c9e82c25b118bc6.exe
    "C:\Users\Admin\AppData\Local\Temp\b10436ebe8849d347c9e82c25b118bc6.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2656
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 676
      2⤵
      • Program crash
      PID:2648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\49555d43-0172-4bb7-9ecb-5664019ac3e9\AgileDotNetRT.dll

    Filesize

    140KB

    MD5

    edd74be9723cdc6a5692954f0e51c9f3

    SHA1

    e9fb66ceee1ba4ce7e5b8271b3e1ed7cb9acf686

    SHA256

    55ff1e0a4e5866d565ceeb9baafac73fdcb4464160fc6c78104d935009935cd7

    SHA512

    80abecdd07f364283f216d8f4d90a4da3efd4561900631fce05c2916afeb1b5bbce23ae92d57430b7b2b06c172b2ad701b2ab75b6dfd2a861abcf7edc38462f3

  • memory/2656-0-0x0000000000800000-0x000000000083E000-memory.dmp

    Filesize

    248KB

  • memory/2656-1-0x0000000074650000-0x0000000074D3E000-memory.dmp

    Filesize

    6.9MB

  • memory/2656-2-0x00000000049D0000-0x0000000004A10000-memory.dmp

    Filesize

    256KB

  • memory/2656-9-0x0000000074210000-0x0000000074238000-memory.dmp

    Filesize

    160KB

  • memory/2656-10-0x0000000074450000-0x00000000744D0000-memory.dmp

    Filesize

    512KB

  • memory/2656-11-0x0000000074650000-0x0000000074D3E000-memory.dmp

    Filesize

    6.9MB

  • memory/2656-12-0x00000000049D0000-0x0000000004A10000-memory.dmp

    Filesize

    256KB

  • memory/2656-13-0x0000000074210000-0x0000000074238000-memory.dmp

    Filesize

    160KB