Analysis
- max time kernel
147s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
25/03/2024, 03:40
General
- Target dd25d1716411318c41f0bcfb84b62311.exe
- Size 211KB
- Sample240325-d79m7afb86
- SHA256 375ec5cd2585db33888d6decbb6a4c60631cb636f3008b31c6b6eb4eea6bcaa7
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd25d1716411318c41f0bcfb84b62311.exe"C:\Users\Admin\AppData\Local\Temp\dd25d1716411318c41f0bcfb84b62311.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
AgileDotNetRT64.dll
memory/4516-0-0x00000000004E0000-0x000000000051A000-memory.dmp
memory/4516-7-0x00007FFA626B0000-0x00007FFA627FE000-memory.dmp
memory/4516-8-0x00007FFA53940000-0x00007FFA54401000-memory.dmp
memory/4516-9-0x00007FFA6C0C0000-0x00007FFA6C0E8000-memory.dmp
memory/4516-10-0x000000001B0F0000-0x000000001B100000-memory.dmp
memory/4516-12-0x00007FFA53940000-0x00007FFA54401000-memory.dmp