Analysis
-
max time kernel
95s -
max time network
101s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
29-05-2024 08:02
General
-
Target
nc.zip
-
Size
1.5MB
-
MD5
620c6a822097c6f0e86fc8f590593e6a
-
SHA1
5ae5ab9dc37c74b27a6757dc0b5dd101e50c658b
-
SHA256
dc922017322363b7679cdb2b7bf9175beb70f8723e32f4f29aff100cb4dbcacf
-
SHA512
68a61a72c6a0fb86af52648a068645e0f5add0d99ed35a0de7ed278c9c16caf9b563358158528086bfc41c0ec046938c21f32e76a8f533e2261b9e9927ab3640
-
SSDEEP
24576:uE6nXDHLmDb3mNSgm+c1KNLfLTv4uMBlxptWP/RiaXMAQkhXW/9z8K8ntM3y7YcX:upXO/MSg/c4FKTWP/RiD0k9z8K8f7EOL
Score
7/10
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\nc.zip1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\NETFLIXCHECKER-VIP.exe"C:\Users\Admin\Desktop\NETFLIXCHECKER-VIP.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
296KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
24KB
-
Filesize
168KB
-
Filesize
56KB
-
Filesize
712KB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB