538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c

General

Target

538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
Size

97KB
MD5

06d8a1accf0a9b34aaee3e1ec50552f0
SHA1

f04d0ecade66d957198bfecc301e5e91e6896189
SHA256

538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c
SHA512

1b2a46e248eef8f5083b7ac35e708a587b248f43d393df154b5e06cb2c867707c53b89a480d7433e7fefa9d8a3f854b2b1a195b2f83755eafbeca0c51a897dca
SSDEEP

768:UWad3TAg33EzacC4Esfi7vpfM6ZHWaddlRf:cFf3PcC4EwiFnf

Score

9^/10

agilenet execution

Malware Config

Signatures

Detects executables packed with Agile.NET / CliSecure 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1928-3-0x0000000005B50000-0x0000000005C54000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet

Drops startup file 2 IoCs

Processes:

Powershell.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe	Powershell.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/1928-3-0x0000000005B50000-0x0000000005C54000-memory.dmp	agile_net

Suspicious use of SetThreadContext 1 IoCs

Processes:

538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe

description	pid	process	target process
PID 1928 set thread context of 2472	1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

Powershell.exe

pid process

2660 Powershell.exe

pid	process
2660	Powershell.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

Processes:

538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exePowershell.exe

pid	process
1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
2660	Powershell.exe
1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exePowershell.exe538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe

description	pid	process
Token: SeDebugPrivilege	1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
Token: SeDebugPrivilege	2660	Powershell.exe
Token: SeDebugPrivilege	2472	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe

C:\Users\Admin\AppData\Local\Temp\538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
"C:\Users\Admin\AppData\Local\Temp\538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1928

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe' -Force
2⤵
- Drops startup file
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2660

C:\Users\Admin\AppData\Local\Temp\538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
"C:\Users\Admin\AppData\Local\Temp\538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe"
2⤵
PID:2488

C:\Users\Admin\AppData\Local\Temp\538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
"C:\Users\Admin\AppData\Local\Temp\538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1928-0-0x0000000073FFE000-0x0000000073FFF000-memory.dmp

Filesize
4KB

Download
memory/1928-1-0x0000000001220000-0x000000000123E000-memory.dmp

Filesize
120KB

Download
memory/1928-2-0x0000000073FF0000-0x00000000746DE000-memory.dmp

Filesize
6.9MB

Download
memory/1928-3-0x0000000005B50000-0x0000000005C54000-memory.dmp

Filesize
1.0MB

Download
memory/2472-48-0x0000000004910000-0x0000000004A20000-memory.dmp

Filesize
1.1MB

Download
memory/2472-12-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2472-2336-0x0000000000E30000-0x0000000000E7C000-memory.dmp

Filesize
304KB

Download
memory/2472-54-0x0000000004910000-0x0000000004A20000-memory.dmp

Filesize
1.1MB

Download
memory/2472-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2472-60-0x0000000004910000-0x0000000004A20000-memory.dmp

Filesize
1.1MB

Download
memory/2472-10-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2472-56-0x0000000004910000-0x0000000004A20000-memory.dmp

Filesize
1.1MB

Download
memory/2472-22-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2472-25-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2472-16-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2472-14-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2472-26-0x0000000004910000-0x0000000004A26000-memory.dmp

Filesize
1.1MB

Download
memory/2472-27-0x0000000004910000-0x0000000004A20000-memory.dmp

Filesize
1.1MB

Download
memory/2472-32-0x0000000004910000-0x0000000004A20000-memory.dmp

Filesize
1.1MB

Download
memory/2472-34-0x0000000004910000-0x0000000004A20000-memory.dmp

Filesize
1.1MB

Download
memory/2472-40-0x0000000004910000-0x0000000004A20000-memory.dmp

Filesize
1.1MB

Download
memory/2472-44-0x0000000004910000-0x0000000004A20000-memory.dmp

Filesize
1.1MB

Download
memory/2472-2335-0x0000000000F80000-0x000000000101E000-memory.dmp

Filesize
632KB

Download
memory/2472-52-0x0000000004910000-0x0000000004A20000-memory.dmp

Filesize
1.1MB

Download
memory/2472-28-0x0000000004910000-0x0000000004A20000-memory.dmp

Filesize
1.1MB

Download
memory/2472-30-0x0000000004910000-0x0000000004A20000-memory.dmp

Filesize
1.1MB

Download
memory/2472-20-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2472-74-0x0000000004910000-0x0000000004A20000-memory.dmp

Filesize
1.1MB

Download
memory/2472-72-0x0000000004910000-0x0000000004A20000-memory.dmp

Filesize
1.1MB

Download
memory/2472-70-0x0000000004910000-0x0000000004A20000-memory.dmp

Filesize
1.1MB

Download
memory/2472-68-0x0000000004910000-0x0000000004A20000-memory.dmp

Filesize
1.1MB

Download
memory/2472-66-0x0000000004910000-0x0000000004A20000-memory.dmp

Filesize
1.1MB

Download
memory/2472-64-0x0000000004910000-0x0000000004A20000-memory.dmp

Filesize
1.1MB

Download
memory/2472-62-0x0000000004910000-0x0000000004A20000-memory.dmp

Filesize
1.1MB

Download
memory/2472-58-0x0000000004910000-0x0000000004A20000-memory.dmp

Filesize
1.1MB

Download
memory/2472-50-0x0000000004910000-0x0000000004A20000-memory.dmp

Filesize
1.1MB

Download
memory/2472-46-0x0000000004910000-0x0000000004A20000-memory.dmp

Filesize
1.1MB

Download
memory/2472-42-0x0000000004910000-0x0000000004A20000-memory.dmp

Filesize
1.1MB

Download
memory/2472-38-0x0000000004910000-0x0000000004A20000-memory.dmp

Filesize
1.1MB

Download
memory/2472-36-0x0000000004910000-0x0000000004A20000-memory.dmp

Filesize
1.1MB

Download
memory/2660-7-0x000000006E5C0000-0x000000006EB6B000-memory.dmp

Filesize
5.7MB

Download
memory/2660-9-0x000000006E5C0000-0x000000006EB6B000-memory.dmp

Filesize
5.7MB

Download
memory/2660-6-0x000000006E5C1000-0x000000006E5C2000-memory.dmp

Filesize
4KB

Download
memory/2660-8-0x000000006E5C0000-0x000000006EB6B000-memory.dmp

Filesize
5.7MB

Download
memory/2660-2338-0x000000006E5C0000-0x000000006EB6B000-memory.dmp

Filesize
5.7MB

Download

description	pid	process	target process
PID 1928 wrote to memory of 2660	1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe	Powershell.exe
PID 1928 wrote to memory of 2660	1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe	Powershell.exe
PID 1928 wrote to memory of 2660	1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe	Powershell.exe
PID 1928 wrote to memory of 2660	1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe	Powershell.exe
PID 1928 wrote to memory of 2488	1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
PID 1928 wrote to memory of 2488	1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
PID 1928 wrote to memory of 2488	1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
PID 1928 wrote to memory of 2488	1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
PID 1928 wrote to memory of 2472	1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
PID 1928 wrote to memory of 2472	1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
PID 1928 wrote to memory of 2472	1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
PID 1928 wrote to memory of 2472	1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
PID 1928 wrote to memory of 2472	1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
PID 1928 wrote to memory of 2472	1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
PID 1928 wrote to memory of 2472	1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
PID 1928 wrote to memory of 2472	1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe
PID 1928 wrote to memory of 2472	1928	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe	538d1dcf99d55168d325f67d6032c5167aad3b7493aec9a44beb55076b86042c.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads