Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
25/04/2024, 17:06
General
- Target Position.exe
- Size 4.8MB
- Sample240425-vmn97ada24
- SHA256 97a781c5442f8ad2d8d8d81d57ecf9e64675afd8eae3bb11bc1575879cd1c9b0
Malware Config
Signatures
- Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Position.exe"C:\Users\Admin\AppData\Local\Temp\Position.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
Armstrong-Extrabold.otf
EXO2-LIGHTITALIC.OTF
memory/3664-57-0x0000000009970000-0x0000000009A86000-memory.dmp
memory/3664-53-0x0000000007B60000-0x0000000007B6A000-memory.dmp
memory/3664-4-0x0000000009CC0000-0x000000000A264000-memory.dmp
memory/3664-5-0x0000000009710000-0x00000000097A2000-memory.dmp
memory/3664-6-0x0000000005A90000-0x0000000005A9A000-memory.dmp
memory/3664-8-0x0000000007980000-0x0000000007992000-memory.dmp
memory/3664-58-0x0000000007D40000-0x0000000007D70000-memory.dmp
memory/3664-54-0x00000000097B0000-0x000000000981A000-memory.dmp
memory/3664-55-0x0000000007CF0000-0x0000000007D0E000-memory.dmp
memory/3664-56-0x0000000009820000-0x000000000996A000-memory.dmp
memory/3664-3-0x0000000005B20000-0x0000000005B30000-memory.dmp
memory/3664-0-0x0000000074BE0000-0x0000000075390000-memory.dmp
memory/3664-67-0x0000000005B20000-0x0000000005B30000-memory.dmp
memory/3664-2-0x0000000008FC0000-0x0000000009514000-memory.dmp
memory/3664-1-0x0000000000C30000-0x00000000010F8000-memory.dmp
memory/3664-66-0x0000000074BE0000-0x0000000075390000-memory.dmp
memory/3664-59-0x0000000005B20000-0x0000000005B30000-memory.dmp
memory/3664-68-0x0000000005B20000-0x0000000005B30000-memory.dmp
memory/4856-69-0x000002A1AFE40000-0x000002A1AFE50000-memory.dmp
memory/4856-85-0x000002A1AFF40000-0x000002A1AFF50000-memory.dmp
memory/4856-101-0x000002A1B8290000-0x000002A1B8291000-memory.dmp
memory/4856-103-0x000002A1B82C0000-0x000002A1B82C1000-memory.dmp
memory/4856-104-0x000002A1B82C0000-0x000002A1B82C1000-memory.dmp
memory/4856-105-0x000002A1B83D0000-0x000002A1B83D1000-memory.dmp