Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
22/03/2024, 00:33
General
- Target ce500cac841937202a07920ee4525f892fa0d962eb807cff83e6201c2c38ab6e.exe
- Size 7.5MB
- Sample240322-awcbrsdf56
- SHA256 ce500cac841937202a07920ee4525f892fa0d962eb807cff83e6201c2c38ab6e
Malware Config
Signatures
- Detects executables packed with Dotfuscator 5 IoCs
- Detects executables packed with Goliath 5 IoCs
- Detects executables packed with SmartAssembly 5 IoCs
- Obfuscated with Agile.Net obfuscator 5 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce500cac841937202a07920ee4525f892fa0d962eb807cff83e6201c2c38ab6e.exe"C:\Users\Admin\AppData\Local\Temp\ce500cac841937202a07920ee4525f892fa0d962eb807cff83e6201c2c38ab6e.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4204 --field-trial-handle=2700,i,14629483171127516024,12350888228055326066,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/376-0-0x0000000000400000-0x0000000000FC3000-memory.dmp
memory/376-1-0x0000000002D40000-0x0000000002D80000-memory.dmp
memory/376-2-0x0000000000400000-0x0000000000FC3000-memory.dmp
memory/376-3-0x0000000000400000-0x0000000000FC3000-memory.dmp
memory/376-4-0x0000000002D90000-0x0000000002D91000-memory.dmp
memory/376-5-0x0000000002D40000-0x0000000002D80000-memory.dmp
memory/376-6-0x0000000076E40000-0x0000000077055000-memory.dmp
memory/376-7-0x0000000075F10000-0x0000000076191000-memory.dmp
memory/376-8-0x0000000074410000-0x0000000074BC0000-memory.dmp
memory/376-9-0x0000000076870000-0x0000000076953000-memory.dmp
memory/376-10-0x0000000000400000-0x0000000000FC3000-memory.dmp
memory/376-11-0x0000000072EA0000-0x0000000072F29000-memory.dmp
memory/376-12-0x0000000000400000-0x0000000000FC3000-memory.dmp
memory/376-13-0x0000000009EA0000-0x0000000009EB0000-memory.dmp
memory/376-14-0x0000000009EB0000-0x000000000A8A2000-memory.dmp
memory/376-15-0x000000000B8A0000-0x000000000BB64000-memory.dmp
memory/376-16-0x000000000BB70000-0x000000000BC89000-memory.dmp
memory/376-17-0x000000000BB70000-0x000000000BC89000-memory.dmp
memory/376-18-0x000000000BB70000-0x000000000BC89000-memory.dmp
memory/376-19-0x000000000BB70000-0x000000000BC89000-memory.dmp
memory/376-20-0x0000000002F40000-0x0000000002F41000-memory.dmp
memory/376-29-0x0000000010000000-0x0000000010005000-memory.dmp
memory/376-30-0x00000000775E0000-0x00000000775E1000-memory.dmp
memory/376-32-0x00000000775B0000-0x00000000775B1000-memory.dmp
memory/376-33-0x0000000010000000-0x0000000010005000-memory.dmp
memory/376-34-0x0000000077610000-0x0000000077611000-memory.dmp
memory/376-37-0x0000000010000000-0x0000000010005000-memory.dmp
memory/376-40-0x0000000010000000-0x0000000010005000-memory.dmp
memory/376-42-0x0000000010000000-0x0000000010005000-memory.dmp
memory/376-45-0x0000000077510000-0x0000000077511000-memory.dmp
memory/376-48-0x0000000077530000-0x0000000077531000-memory.dmp
memory/376-47-0x00000000755D0000-0x0000000075B83000-memory.dmp
memory/376-50-0x0000000077520000-0x0000000077521000-memory.dmp
memory/376-49-0x0000000077550000-0x0000000077551000-memory.dmp
memory/376-52-0x00000000775C0000-0x00000000775C1000-memory.dmp
memory/376-51-0x0000000000400000-0x0000000000FC3000-memory.dmp
memory/376-53-0x0000000077590000-0x0000000077591000-memory.dmp
memory/376-54-0x0000000077580000-0x0000000077581000-memory.dmp
memory/376-56-0x0000000002D40000-0x0000000002D80000-memory.dmp
memory/376-55-0x00000000775D0000-0x00000000775D1000-memory.dmp
memory/376-57-0x000000000F400000-0x000000000F492000-memory.dmp
memory/376-58-0x0000000010210000-0x0000000010254000-memory.dmp
memory/376-60-0x0000000010210000-0x0000000010254000-memory.dmp
memory/376-63-0x0000000010210000-0x0000000010254000-memory.dmp
memory/376-66-0x0000000010210000-0x0000000010254000-memory.dmp
memory/376-73-0x000000000FFD0000-0x000000000FFF2000-memory.dmp
memory/376-74-0x00000000102D0000-0x0000000010874000-memory.dmp
memory/376-75-0x0000000010880000-0x00000000108E6000-memory.dmp
memory/376-76-0x00000000108F0000-0x00000000108FA000-memory.dmp
memory/376-78-0x00000000108F0000-0x00000000108FA000-memory.dmp
memory/376-81-0x00000000108F0000-0x00000000108FA000-memory.dmp
memory/376-84-0x00000000108F0000-0x00000000108FA000-memory.dmp
memory/376-91-0x0000000010930000-0x000000001094A000-memory.dmp
memory/376-106-0x0000000011170000-0x0000000011178000-memory.dmp
memory/376-135-0x0000000011180000-0x000000001118C000-memory.dmp
memory/376-148-0x0000000000400000-0x0000000000FC3000-memory.dmp
memory/376-150-0x0000000009EA0000-0x0000000009EB0000-memory.dmp
memory/376-158-0x00000000111B0000-0x00000000111CE000-memory.dmp
memory/376-159-0x00000000111D0000-0x00000000111F2000-memory.dmp
memory/376-187-0x00000000112A0000-0x000000001130E000-memory.dmp
memory/376-201-0x0000000011230000-0x000000001124C000-memory.dmp
memory/376-215-0x00000000111B0000-0x00000000111BA000-memory.dmp
memory/376-229-0x0000000011560000-0x000000001156A000-memory.dmp
memory/376-230-0x00000000115A0000-0x00000000115A8000-memory.dmp
memory/376-275-0x0000000012410000-0x0000000012418000-memory.dmp
memory/376-276-0x00000000123D0000-0x00000000123DA000-memory.dmp
memory/376-290-0x0000000012480000-0x00000000124D4000-memory.dmp
memory/376-304-0x0000000012400000-0x000000001240E000-memory.dmp
memory/376-318-0x0000000012420000-0x000000001242E000-memory.dmp
memory/376-332-0x00000000124E0000-0x0000000012510000-memory.dmp
memory/376-346-0x0000000012510000-0x0000000012542000-memory.dmp
memory/376-361-0x0000000014820000-0x0000000014838000-memory.dmp
memory/376-400-0x0000000014970000-0x000000001497A000-memory.dmp
memory/376-414-0x0000000014AA0000-0x0000000014BB4000-memory.dmp
memory/376-419-0x0000000074410000-0x0000000074BC0000-memory.dmp
memory/376-430-0x00000000149D0000-0x00000000149F6000-memory.dmp
memory/376-445-0x00000000149B0000-0x00000000149BA000-memory.dmp
memory/376-446-0x0000000009EA0000-0x0000000009EB0000-memory.dmp
memory/376-491-0x000000000BB70000-0x000000000BC89000-memory.dmp
memory/376-536-0x0000000009EA0000-0x0000000009EB0000-memory.dmp