Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-05-2024 01:35
Behavioral task
behavioral1
Sample
FRPFILE AIO v2.8.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
FRPFILE AIO v2.8.exe
Resource
win10v2004-20240226-en
General
-
Target
FRPFILE AIO v2.8.exe
-
Size
3.6MB
-
MD5
35a75ac8ad394a1baf1f3f6ac2345c20
-
SHA1
004ebce7f5de3f7011d70d5228d9d42c5adde083
-
SHA256
9810adae2ead6fdcbb3560f8eb4eb4ae2e41ba3757fb5afbabcf9426f2b7f72d
-
SHA512
ddaab8467833a46a605ac1873ad89cb0ea2517138edb4556bba3a1cd9919ce709a5ea481f27afce9913908f87255b3f4863601aafd0c11ed669a617219251305
-
SSDEEP
49152:odzejqO7IbIwWAKlALzIq242Z3DdYc5lICecVVrFA/lvRJyNczzldX4ti4F7yqun:o9e2UlAYq2J3D5Vec/poRU4PXQ1FeqE
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
FRPFILE AIO v2.8.exepid process 2288 FRPFILE AIO v2.8.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/2288-1-0x00000000000D0000-0x0000000000470000-memory.dmp agile_net -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
FRPFILE AIO v2.8.exepid process 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe 2288 FRPFILE AIO v2.8.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
FRPFILE AIO v2.8.exedescription pid process Token: SeDebugPrivilege 2288 FRPFILE AIO v2.8.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\fdc0f96d-9124-4adc-ac3d-8831860e8023\AgileDotNetRT.dllFilesize
94KB
MD514ff402962ad21b78ae0b4c43cd1f194
SHA1f8a510eb26666e875a5bdd1cadad40602763ad72
SHA256fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b
SHA512daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b
-
memory/2288-13-0x00000000060A0000-0x000000000614A000-memory.dmpFilesize
680KB
-
memory/2288-14-0x0000000074430000-0x0000000074B1E000-memory.dmpFilesize
6.9MB
-
memory/2288-1-0x00000000000D0000-0x0000000000470000-memory.dmpFilesize
3.6MB
-
memory/2288-9-0x0000000074C80000-0x0000000074D00000-memory.dmpFilesize
512KB
-
memory/2288-10-0x0000000006760000-0x0000000006AA2000-memory.dmpFilesize
3.3MB
-
memory/2288-11-0x0000000002140000-0x000000000219C000-memory.dmpFilesize
368KB
-
memory/2288-2-0x0000000074430000-0x0000000074B1E000-memory.dmpFilesize
6.9MB
-
memory/2288-0-0x000000007443E000-0x000000007443F000-memory.dmpFilesize
4KB
-
memory/2288-12-0x0000000005630000-0x00000000056FA000-memory.dmpFilesize
808KB
-
memory/2288-15-0x0000000002250000-0x0000000002264000-memory.dmpFilesize
80KB
-
memory/2288-16-0x0000000002260000-0x000000000227A000-memory.dmpFilesize
104KB
-
memory/2288-17-0x000000007443E000-0x000000007443F000-memory.dmpFilesize
4KB
-
memory/2288-18-0x0000000074430000-0x0000000074B1E000-memory.dmpFilesize
6.9MB
-
memory/2288-19-0x0000000074430000-0x0000000074B1E000-memory.dmpFilesize
6.9MB
-
memory/2288-20-0x0000000074430000-0x0000000074B1E000-memory.dmpFilesize
6.9MB