Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
05-05-2024 11:48
Static task
static1
Behavioral task
behavioral1
Sample
ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral2
Sample
ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe
Resource
win11-20240419-en
General
-
Target
ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe
-
Size
2.0MB
-
MD5
0ffb5f463f6c63d11a48d2b4ef3be8dd
-
SHA1
997a45a3707dd6ac76765664503576d3f6a37cb3
-
SHA256
ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3
-
SHA512
3505ed0ac12a63cf054ee1a0863204cba196c5c7026b9cdfae55ca1371092f9b809a491ca01de81d0605b302bc96e23e4a64064368002fc80138218c638fc468
-
SSDEEP
49152:ZWFxPJFPcZYQKes8mugsPngHr79/Hx8vkXhWF+DDxaUKY:ZoxPyw8mRPmvRF4DQ4
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
Processes:
ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exepid process 3452 ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe 3452 ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe -
Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\4E07515B.dll agile_net behavioral2/memory/3452-8-0x0000000004F50000-0x000000000508A000-memory.dmp agile_net -
Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
Processes:
ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exepid process 3452 ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe 3452 ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe 3452 ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe 3452 ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe 3452 ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe 3452 ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe 3452 ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe 3452 ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe 3452 ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe 3452 ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exepid process 3452 ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe 3452 ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exedescription pid process Token: SeDebugPrivilege 3452 ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.execmd.exedescription pid process target process PID 3452 wrote to memory of 2444 3452 ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe cmd.exe PID 3452 wrote to memory of 2444 3452 ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe cmd.exe PID 3452 wrote to memory of 2444 3452 ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe cmd.exe PID 2444 wrote to memory of 4888 2444 cmd.exe choice.exe PID 2444 wrote to memory of 4888 2444 cmd.exe choice.exe PID 2444 wrote to memory of 4888 2444 cmd.exe choice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe"C:\Users\Admin\AppData\Local\Temp\ae3da52225038e4f4ad470079fa2c2c08a3481456e1734e3953e539bdedc1ea3.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\4E07515B.dll" /A:H2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 33⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4E07515B.dllFilesize
551KB
MD50e7d38086b978ce94f32e916b216ff29
SHA1462108a73d1ec0d9a5b76f08a9af3c4241c5dae8
SHA256012d051f54d282075c3d147761a5b303ab74cefbb35db366a40315ef11a40c0a
SHA5126ef0b27b16fa9c66817df09bdb99cf37dd4517201ff589f5604a3943c40b475e33936f5a1ad6b0d89c08e56065bd3c5ba612f3c9667b8d83a7c21becf3755a43
-
memory/3452-11-0x0000000074670000-0x0000000074E21000-memory.dmpFilesize
7.7MB
-
memory/3452-4-0x0000000074670000-0x0000000074E21000-memory.dmpFilesize
7.7MB
-
memory/3452-1-0x00000000000E0000-0x00000000002E0000-memory.dmpFilesize
2.0MB
-
memory/3452-8-0x0000000004F50000-0x000000000508A000-memory.dmpFilesize
1.2MB
-
memory/3452-10-0x0000000074670000-0x0000000074E21000-memory.dmpFilesize
7.7MB
-
memory/3452-0-0x000000007467E000-0x000000007467F000-memory.dmpFilesize
4KB
-
memory/3452-12-0x0000000004800000-0x0000000004806000-memory.dmpFilesize
24KB
-
memory/3452-14-0x0000000074670000-0x0000000074E21000-memory.dmpFilesize
7.7MB
-
memory/3452-15-0x0000000005500000-0x0000000005676000-memory.dmpFilesize
1.5MB
-
memory/3452-16-0x0000000006270000-0x0000000006816000-memory.dmpFilesize
5.6MB
-
memory/3452-17-0x00000000059B0000-0x0000000005A42000-memory.dmpFilesize
584KB
-
memory/3452-19-0x0000000074670000-0x0000000074E21000-memory.dmpFilesize
7.7MB