Analysis

  • max time kernel
    15s
  • max time network
    14s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-04-2024 18:04

General

  • Target

    GrayWolf.exe

  • Size

    5.4MB

  • MD5

    02a88d03242515576fa54218538e34fa

  • SHA1

    ed6f90fcbf9fabf0da167987e1c2647833df5d6e

  • SHA256

    533afe3493caae3a36d03f7766aeeec4de9f682a76d73b8098f975daacf48c0b

  • SHA512

    b9b0a03500e5ef66569dc42b07c5da6c186660989403bafd9f8511303add0622f8a9f670f73dffa3ddd8fe044b82c4e26a4ad6ae6e1aa0898c72b3ef671e09d5

  • SSDEEP

    49152:jF/5OwXqsw+mw6j4w6SAZplWz3SUcSUWrXxRyJQfSqF6kr3Az0:j/B0rQgCUcSUWOv98J

Score
7/10

Malware Config

Signatures

  • Obfuscated with Agile.Net obfuscator 2 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

Processes

  • C:\Users\Admin\AppData\Local\Temp\GrayWolf.exe
    "C:\Users\Admin\AppData\Local\Temp\GrayWolf.exe"
    1⤵
      PID:4992

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4992-0-0x00007FF8C8190000-0x00007FF8C8C51000-memory.dmp

      Filesize

      10.8MB

    • memory/4992-1-0x00000000005D0000-0x0000000000B36000-memory.dmp

      Filesize

      5.4MB

    • memory/4992-3-0x0000000002CA0000-0x0000000002CA8000-memory.dmp

      Filesize

      32KB

    • memory/4992-2-0x0000000002C90000-0x0000000002C98000-memory.dmp

      Filesize

      32KB

    • memory/4992-4-0x0000000002CB0000-0x0000000002CC6000-memory.dmp

      Filesize

      88KB

    • memory/4992-5-0x000000001B740000-0x000000001B926000-memory.dmp

      Filesize

      1.9MB

    • memory/4992-6-0x000000001B630000-0x000000001B6E2000-memory.dmp

      Filesize

      712KB

    • memory/4992-7-0x0000000002CC0000-0x0000000002CD0000-memory.dmp

      Filesize

      64KB

    • memory/4992-8-0x0000000002CD0000-0x0000000002CE0000-memory.dmp

      Filesize

      64KB

    • memory/4992-9-0x0000000002CE0000-0x0000000002CEC000-memory.dmp

      Filesize

      48KB

    • memory/4992-10-0x0000000002CF0000-0x0000000002CF8000-memory.dmp

      Filesize

      32KB

    • memory/4992-11-0x0000000002D00000-0x0000000002D1A000-memory.dmp

      Filesize

      104KB

    • memory/4992-12-0x0000000002D20000-0x0000000002D4E000-memory.dmp

      Filesize

      184KB

    • memory/4992-13-0x000000001B6E0000-0x000000001B6F8000-memory.dmp

      Filesize

      96KB

    • memory/4992-14-0x000000001B930000-0x000000001B964000-memory.dmp

      Filesize

      208KB

    • memory/4992-15-0x000000001B700000-0x000000001B70A000-memory.dmp

      Filesize

      40KB

    • memory/4992-16-0x000000001B710000-0x000000001B718000-memory.dmp

      Filesize

      32KB

    • memory/4992-17-0x000000001B720000-0x000000001B72C000-memory.dmp

      Filesize

      48KB

    • memory/4992-18-0x000000001B970000-0x000000001B97C000-memory.dmp

      Filesize

      48KB

    • memory/4992-19-0x000000001B980000-0x000000001B9E8000-memory.dmp

      Filesize

      416KB

    • memory/4992-20-0x000000001B9F0000-0x000000001B9F8000-memory.dmp

      Filesize

      32KB

    • memory/4992-21-0x000000001BA00000-0x000000001BA4A000-memory.dmp

      Filesize

      296KB

    • memory/4992-22-0x000000001BA50000-0x000000001BAE8000-memory.dmp

      Filesize

      608KB

    • memory/4992-23-0x000000001BAF0000-0x000000001BB3C000-memory.dmp

      Filesize

      304KB

    • memory/4992-24-0x000000001BB40000-0x000000001BB48000-memory.dmp

      Filesize

      32KB

    • memory/4992-25-0x000000001BB50000-0x000000001BB58000-memory.dmp

      Filesize

      32KB

    • memory/4992-26-0x000000001BB60000-0x000000001BB6C000-memory.dmp

      Filesize

      48KB

    • memory/4992-27-0x000000001BC60000-0x000000001BC70000-memory.dmp

      Filesize

      64KB

    • memory/4992-28-0x000000001D340000-0x000000001D35C000-memory.dmp

      Filesize

      112KB

    • memory/4992-29-0x000000001BC60000-0x000000001BC70000-memory.dmp

      Filesize

      64KB

    • memory/4992-30-0x000000001BC60000-0x000000001BC70000-memory.dmp

      Filesize

      64KB

    • memory/4992-31-0x000000001BC60000-0x000000001BC70000-memory.dmp

      Filesize

      64KB