ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3

General

Target

ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe
Size

2.0MB
MD5

0ffb5f463f6c63d11a48d2b4ef3be8dd
SHA1

997a45a3707dd6ac76765664503576d3f6a37cb3
SHA256

ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3
SHA512

3505ed0ac12a63cf054ee1a0863204cba196c5c7026b9cdfae55ca1371092f9b809a491ca01de81d0605b302bc96e23e4a64064368002fc80138218c638fc468
SSDEEP

49152:ZWFxPJFPcZYQKes8mugsPngHr79/Hx8vkXhWF+DDxaUKY:ZoxPyw8mRPmvRF4DQ4

Score

7^/10

agilenet

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation	ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe

Loads dropped DLL 2 IoCs

Processes:

ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe

pid	process
4224	ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe
4224	ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe

Obfuscated with Agile.Net obfuscator 2 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/4224-8-0x0000000004CF0000-0x0000000004E2A000-memory.dmp	agile_net
C:\Users\Admin\AppData\Local\Temp\4E07515B.dll	agile_net

Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs

Processes:

ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe

pid	process
4224	ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe
4224	ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe
4224	ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe
4224	ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe
4224	ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe
4224	ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe
4224	ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe
4224	ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe
4224	ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe
4224	ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe

pid	process
4224	ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe
4224	ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe

description pid process

Token: SeDebugPrivilege 4224 ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe

description	pid	process
Token: SeDebugPrivilege	4224	ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.execmd.exe

description	pid	process	target process
PID 4224 wrote to memory of 1892	4224	ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe	cmd.exe
PID 4224 wrote to memory of 1892	4224	ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe	cmd.exe
PID 4224 wrote to memory of 1892	4224	ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe	cmd.exe
PID 1892 wrote to memory of 380	1892	cmd.exe	choice.exe
PID 1892 wrote to memory of 380	1892	cmd.exe	choice.exe
PID 1892 wrote to memory of 380	1892	cmd.exe	choice.exe

C:\Users\Admin\AppData\Local\Temp\ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe
"C:\Users\Admin\AppData\Local\Temp\ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4224

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\4E07515B.dll" /A:H
2⤵
- Suspicious use of WriteProcessMemory
PID:1892

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
3⤵
PID:380

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4E07515B.dll
Filesize
551KB

MD5
0e7d38086b978ce94f32e916b216ff29

SHA1
462108a73d1ec0d9a5b76f08a9af3c4241c5dae8

SHA256
012d051f54d282075c3d147761a5b303ab74cefbb35db366a40315ef11a40c0a

SHA512
6ef0b27b16fa9c66817df09bdb99cf37dd4517201ff589f5604a3943c40b475e33936f5a1ad6b0d89c08e56065bd3c5ba612f3c9667b8d83a7c21becf3755a43

Download Submit
memory/4224-0-0x0000000074C6E000-0x0000000074C6F000-memory.dmp

Filesize
4KB

Download
memory/4224-1-0x0000000000010000-0x0000000000210000-memory.dmp

Filesize
2.0MB

Download
memory/4224-4-0x0000000074C60000-0x0000000075410000-memory.dmp

Filesize
7.7MB

Download
memory/4224-8-0x0000000004CF0000-0x0000000004E2A000-memory.dmp

Filesize
1.2MB

Download
memory/4224-10-0x0000000074C60000-0x0000000075410000-memory.dmp

Filesize
7.7MB

Download
memory/4224-11-0x0000000074C60000-0x0000000075410000-memory.dmp

Filesize
7.7MB

Download
memory/4224-12-0x0000000004680000-0x0000000004686000-memory.dmp

Filesize
24KB

Download
memory/4224-14-0x00000000051F0000-0x0000000005366000-memory.dmp

Filesize
1.5MB

Download
memory/4224-15-0x0000000005DA0000-0x0000000006344000-memory.dmp

Filesize
5.6MB

Download
memory/4224-16-0x0000000005720000-0x00000000057B2000-memory.dmp

Filesize
584KB

Download
memory/4224-18-0x0000000074C60000-0x0000000075410000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads