80116b9c6705b19dbc6b95a576427e4df2b544fb2008ef87f84036ab13b5dccf

General

Target

80116b9c6705b19dbc6b95a576427e4df2b544fb2008ef87f84036ab13b5dccf.exe
Size

13.1MB
MD5

d9cc6c9b37963d2378d3e5e8a6d9ad4c
SHA1

27a01b57b18a910f4a8e76cac7b3fcd16ffd3b5c
SHA256

80116b9c6705b19dbc6b95a576427e4df2b544fb2008ef87f84036ab13b5dccf
SHA512

efd45922356aa7c896212567a9066c0c6ff58ff308f3c354f4cb89c35d7a1386756eb573962ceef49bf5c50a6c724718d8d16010a4ed291a6cb8c1e7abbbc9bf
SSDEEP

393216:OqqiiUpkr2dY/aBcjJOBHOBIQBajMtWvoJiLE1+XgRKz89G/4ZSb0Funwh6DsN2v:rpkr2dY/aBcjJOBHOBIQBajMtWvoJiLn

Score

7^/10

agilenet

Malware Config

Signatures

Obfuscated with Agile.Net obfuscator 3 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/3008-6-0x00000000024F0000-0x0000000002556000-memory.dmp	agile_net
behavioral1/memory/3008-14-0x0000000002760000-0x0000000002782000-memory.dmp	agile_net
behavioral1/memory/3008-71-0x00000000099A0000-0x00000000099C2000-memory.dmp	agile_net

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

80116b9c6705b19dbc6b95a576427e4df2b544fb2008ef87f84036ab13b5dccf.exe

pid process

3008 80116b9c6705b19dbc6b95a576427e4df2b544fb2008ef87f84036ab13b5dccf.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

80116b9c6705b19dbc6b95a576427e4df2b544fb2008ef87f84036ab13b5dccf.exe

description pid process

Token: SeDebugPrivilege 3008 80116b9c6705b19dbc6b95a576427e4df2b544fb2008ef87f84036ab13b5dccf.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

80116b9c6705b19dbc6b95a576427e4df2b544fb2008ef87f84036ab13b5dccf.exe

pid process

3008 80116b9c6705b19dbc6b95a576427e4df2b544fb2008ef87f84036ab13b5dccf.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

80116b9c6705b19dbc6b95a576427e4df2b544fb2008ef87f84036ab13b5dccf.exe

pid process

3008 80116b9c6705b19dbc6b95a576427e4df2b544fb2008ef87f84036ab13b5dccf.exe

pid	process
3008	80116b9c6705b19dbc6b95a576427e4df2b544fb2008ef87f84036ab13b5dccf.exe

description	pid	process
Token: SeDebugPrivilege	3008	80116b9c6705b19dbc6b95a576427e4df2b544fb2008ef87f84036ab13b5dccf.exe

pid	process
3008	80116b9c6705b19dbc6b95a576427e4df2b544fb2008ef87f84036ab13b5dccf.exe

pid	process
3008	80116b9c6705b19dbc6b95a576427e4df2b544fb2008ef87f84036ab13b5dccf.exe

C:\Users\Admin\AppData\Local\Temp\80116b9c6705b19dbc6b95a576427e4df2b544fb2008ef87f84036ab13b5dccf.exe
"C:\Users\Admin\AppData\Local\Temp\80116b9c6705b19dbc6b95a576427e4df2b544fb2008ef87f84036ab13b5dccf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\evb2CE1.tmp
Filesize
1KB

MD5
e10fba65e25939099efc1a1162417a38

SHA1
6caa91c88d255dd6ea5bb774219e0c162350f0bc

SHA256
634d7e9ba6e90b5fab74ea3e8d05d8b341be5e69c1175c4f62d99a0015e76a8d

SHA512
6a8b3d8bcabb0f505db687e58f9fe19df00a98ebe4b1e49f5e19bbef3ad431e085dfd16e0f56acea5504df5ba606e0d4c3510e0de00ec224d90fb224090cdc7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb3942.tmp
Filesize
1KB

MD5
74887ca999f4b8ffffe5cf8332228a97

SHA1
a8ba417a457c8e7c3249c5886d2b557069e6ff83

SHA256
54903acc19ebb20f8baa54f7762321d9fdbdaef33c65810f514f13c83274ad48

SHA512
9d44835d57674f2cac1469b614d8702d215ba08808cc5748d92699a979d9b2135b9211984e90c42ea3c9e40ab4c04181fa7bca81a93b891da1ad634a45decc19

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb3C8F.tmp
Filesize
1KB

MD5
3484fc718591b1bc922890aa43c55084

SHA1
dbdf7a239f5c41e5fe659e56a6dd42e892d6c1c7

SHA256
6dd23f620a9b78941e5ae2b7cf8de1a83a3cc0367d2dd31d456162522c4f9c89

SHA512
e00ac233dfff6bf17515d1c38d0c3b0f132bebbfa57f8fb74e1903d16239332b43f80bce12b3091ff277be2877669837eeb8f3a6046a471a53e53456947642c3

Download Submit
memory/3008-23-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/3008-2-0x0000000000400000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download
memory/3008-10-0x0000000005AD0000-0x0000000005B10000-memory.dmp

Filesize
256KB

Download
memory/3008-14-0x0000000002760000-0x0000000002782000-memory.dmp

Filesize
136KB

Download
memory/3008-18-0x0000000002770000-0x0000000002786000-memory.dmp

Filesize
88KB

Download
memory/3008-19-0x0000000005AD0000-0x0000000005B10000-memory.dmp

Filesize
256KB

Download
memory/3008-20-0x0000000005AD0000-0x0000000005B10000-memory.dmp

Filesize
256KB

Download
memory/3008-1-0x00000000774C0000-0x00000000774C1000-memory.dmp

Filesize
4KB

Download
memory/3008-27-0x0000000000400000-0x0000000000558000-memory.dmp

Filesize
1.3MB

Download
memory/3008-6-0x00000000024F0000-0x0000000002556000-memory.dmp

Filesize
408KB

Download
memory/3008-34-0x0000000074490000-0x0000000074B7E000-memory.dmp

Filesize
6.9MB

Download
memory/3008-3-0x0000000074490000-0x0000000074B7E000-memory.dmp

Filesize
6.9MB

Download
memory/3008-41-0x0000000005AD0000-0x0000000005B10000-memory.dmp

Filesize
256KB

Download
memory/3008-0-0x0000000000400000-0x0000000000558000-memory.dmp

Filesize
1.3MB

Download
memory/3008-55-0x0000000005AD0000-0x0000000005B10000-memory.dmp

Filesize
256KB

Download
memory/3008-56-0x0000000005AD0000-0x0000000005B10000-memory.dmp

Filesize
256KB

Download
memory/3008-70-0x00000000099A0000-0x00000000099C2000-memory.dmp

Filesize
136KB

Download
memory/3008-71-0x00000000099A0000-0x00000000099C2000-memory.dmp

Filesize
136KB

Download
memory/3008-72-0x00000000099A0000-0x0000000009A06000-memory.dmp

Filesize
408KB

Download
memory/3008-73-0x00000000099A0000-0x0000000009A06000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads