Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-06-2024 18:58
Static task
static1
Behavioral task
behavioral1
Sample
1023258878.exe
Resource
win10v2004-20240508-en
General
-
Target
1023258878.exe
-
Size
7.5MB
-
MD5
0cc3705c67e8aa158439a457b33c4283
-
SHA1
bc20c3308339f789128d245674b666398c0384fd
-
SHA256
245b81093e88cc624a12296580a30a64d408b006e50b59ed5f64d5d687e4c09a
-
SHA512
8a34946fa1f510e39911af0ef6405a3e4c07df289950291c2313f9f7fc460e1ec6e4282a9ee08c1741f472e49238ed0234e758d382a9b7fd651a78dbd1271fae
-
SSDEEP
196608:0ds1VjAXZARCfxSqCeHUn4XCGXhpTD0NvKZGsKijlZ:0sfsJffsje0n4yGXhm5KZpBZ
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 28 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/4544-3-0x0000000000400000-0x0000000000FD3000-memory.dmp agile_net behavioral1/memory/4544-8-0x0000000000400000-0x0000000000FD3000-memory.dmp agile_net behavioral1/memory/4544-10-0x0000000000400000-0x0000000000FD3000-memory.dmp agile_net behavioral1/memory/4544-12-0x0000000000400000-0x0000000000FD3000-memory.dmp agile_net behavioral1/memory/4544-13-0x0000000000400000-0x0000000000FD3000-memory.dmp agile_net behavioral1/memory/4544-25-0x0000000000400000-0x0000000000FD3000-memory.dmp agile_net behavioral1/memory/4544-43-0x0000000000400000-0x0000000000FD3000-memory.dmp agile_net behavioral1/memory/4544-44-0x0000000000400000-0x0000000000FD3000-memory.dmp agile_net behavioral1/memory/4544-45-0x0000000000400000-0x0000000000FD3000-memory.dmp agile_net behavioral1/memory/4544-46-0x0000000000400000-0x0000000000FD3000-memory.dmp agile_net behavioral1/memory/4544-48-0x0000000000400000-0x0000000000FD3000-memory.dmp agile_net behavioral1/memory/4544-49-0x0000000000400000-0x0000000000FD3000-memory.dmp agile_net behavioral1/memory/4544-67-0x0000000000400000-0x0000000000FD3000-memory.dmp agile_net behavioral1/memory/4544-89-0x0000000000400000-0x0000000000FD3000-memory.dmp agile_net behavioral1/memory/4544-325-0x0000000000400000-0x0000000000FD3000-memory.dmp agile_net behavioral1/memory/4544-415-0x0000000000400000-0x0000000000FD3000-memory.dmp agile_net behavioral1/memory/4544-416-0x0000000000400000-0x0000000000FD3000-memory.dmp agile_net behavioral1/memory/4544-417-0x0000000000400000-0x0000000000FD3000-memory.dmp agile_net behavioral1/memory/4544-418-0x0000000000400000-0x0000000000FD3000-memory.dmp agile_net behavioral1/memory/4544-463-0x0000000000400000-0x0000000000FD3000-memory.dmp agile_net behavioral1/memory/4544-464-0x000000000089E000-0x0000000000FA1000-memory.dmp agile_net behavioral1/memory/4544-465-0x0000000000400000-0x0000000000FD3000-memory.dmp agile_net behavioral1/memory/4544-466-0x0000000000400000-0x0000000000FD3000-memory.dmp agile_net behavioral1/memory/4544-511-0x0000000000400000-0x0000000000FD3000-memory.dmp agile_net behavioral1/memory/4544-512-0x0000000000400000-0x0000000000FD3000-memory.dmp agile_net behavioral1/memory/4544-513-0x0000000000400000-0x0000000000FD3000-memory.dmp agile_net behavioral1/memory/4544-558-0x0000000000400000-0x0000000000FD3000-memory.dmp agile_net behavioral1/memory/4544-559-0x0000000000400000-0x0000000000FD3000-memory.dmp agile_net -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
1023258878.exepid process 4544 1023258878.exe 4544 1023258878.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1023258878.exepid process 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe 4544 1023258878.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
1023258878.exedescription pid process Token: SeDebugPrivilege 4544 1023258878.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
1023258878.exepid process 4544 1023258878.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4544-0-0x0000000000400000-0x0000000000FD3000-memory.dmpFilesize
11.8MB
-
memory/4544-1-0x000000000089E000-0x0000000000FA1000-memory.dmpFilesize
7.0MB
-
memory/4544-2-0x0000000000400000-0x0000000000FD3000-memory.dmpFilesize
11.8MB
-
memory/4544-4-0x0000000002C10000-0x0000000002C11000-memory.dmpFilesize
4KB
-
memory/4544-5-0x0000000002C50000-0x0000000002C90000-memory.dmpFilesize
256KB
-
memory/4544-3-0x0000000000400000-0x0000000000FD3000-memory.dmpFilesize
11.8MB
-
memory/4544-6-0x0000000077150000-0x0000000077365000-memory.dmpFilesize
2.1MB
-
memory/4544-7-0x0000000076820000-0x0000000076AA1000-memory.dmpFilesize
2.5MB
-
memory/4544-8-0x0000000000400000-0x0000000000FD3000-memory.dmpFilesize
11.8MB
-
memory/4544-9-0x0000000076730000-0x0000000076813000-memory.dmpFilesize
908KB
-
memory/4544-10-0x0000000000400000-0x0000000000FD3000-memory.dmpFilesize
11.8MB
-
memory/4544-11-0x00000000733F0000-0x0000000073479000-memory.dmpFilesize
548KB
-
memory/4544-12-0x0000000000400000-0x0000000000FD3000-memory.dmpFilesize
11.8MB
-
memory/4544-13-0x0000000000400000-0x0000000000FD3000-memory.dmpFilesize
11.8MB
-
memory/4544-14-0x0000000009CD0000-0x000000000A6C2000-memory.dmpFilesize
9.9MB
-
memory/4544-15-0x000000000B6C0000-0x000000000B984000-memory.dmpFilesize
2.8MB
-
memory/4544-16-0x000000000B990000-0x000000000BAA9000-memory.dmpFilesize
1.1MB
-
memory/4544-25-0x0000000000400000-0x0000000000FD3000-memory.dmpFilesize
11.8MB
-
memory/4544-18-0x000000000B990000-0x000000000BAA9000-memory.dmpFilesize
1.1MB
-
memory/4544-17-0x000000000B990000-0x000000000BAA9000-memory.dmpFilesize
1.1MB
-
memory/4544-38-0x0000000010000000-0x0000000010005000-memory.dmpFilesize
20KB
-
memory/4544-43-0x0000000000400000-0x0000000000FD3000-memory.dmpFilesize
11.8MB
-
memory/4544-36-0x0000000010000000-0x0000000010005000-memory.dmpFilesize
20KB
-
memory/4544-33-0x0000000010000000-0x0000000010005000-memory.dmpFilesize
20KB
-
memory/4544-30-0x0000000010000000-0x0000000010005000-memory.dmpFilesize
20KB
-
memory/4544-42-0x0000000075B20000-0x00000000760D3000-memory.dmpFilesize
5.7MB
-
memory/4544-28-0x0000000010000000-0x0000000010005000-memory.dmpFilesize
20KB
-
memory/4544-44-0x0000000000400000-0x0000000000FD3000-memory.dmpFilesize
11.8MB
-
memory/4544-45-0x0000000000400000-0x0000000000FD3000-memory.dmpFilesize
11.8MB
-
memory/4544-46-0x0000000000400000-0x0000000000FD3000-memory.dmpFilesize
11.8MB
-
memory/4544-47-0x000000000F2F0000-0x000000000F382000-memory.dmpFilesize
584KB
-
memory/4544-48-0x0000000000400000-0x0000000000FD3000-memory.dmpFilesize
11.8MB
-
memory/4544-49-0x0000000000400000-0x0000000000FD3000-memory.dmpFilesize
11.8MB
-
memory/4544-66-0x000000000FFA0000-0x000000000FFC2000-memory.dmpFilesize
136KB
-
memory/4544-67-0x0000000000400000-0x0000000000FD3000-memory.dmpFilesize
11.8MB
-
memory/4544-69-0x0000000010790000-0x00000000107F6000-memory.dmpFilesize
408KB
-
memory/4544-86-0x0000000010800000-0x000000001081A000-memory.dmpFilesize
104KB
-
memory/4544-85-0x0000000010110000-0x000000001011A000-memory.dmpFilesize
40KB
-
memory/4544-75-0x000000000FFF0000-0x000000000FFFA000-memory.dmpFilesize
40KB
-
memory/4544-72-0x000000000FFF0000-0x000000000FFFA000-memory.dmpFilesize
40KB
-
memory/4544-70-0x000000000FFF0000-0x000000000FFFA000-memory.dmpFilesize
40KB
-
memory/4544-87-0x0000000010B30000-0x0000000010B52000-memory.dmpFilesize
136KB
-
memory/4544-68-0x00000000101A0000-0x0000000010744000-memory.dmpFilesize
5.6MB
-
memory/4544-65-0x0000000010150000-0x0000000010194000-memory.dmpFilesize
272KB
-
memory/4544-55-0x000000000FFA0000-0x000000000FFE4000-memory.dmpFilesize
272KB
-
memory/4544-52-0x000000000FFA0000-0x000000000FFE4000-memory.dmpFilesize
272KB
-
memory/4544-50-0x000000000FFA0000-0x000000000FFE4000-memory.dmpFilesize
272KB
-
memory/4544-89-0x0000000000400000-0x0000000000FD3000-memory.dmpFilesize
11.8MB
-
memory/4544-118-0x0000000010EE0000-0x0000000010EFE000-memory.dmpFilesize
120KB
-
memory/4544-180-0x0000000010CB0000-0x0000000010CBA000-memory.dmpFilesize
40KB
-
memory/4544-144-0x0000000011170000-0x00000000111DE000-memory.dmpFilesize
440KB
-
memory/4544-166-0x0000000011100000-0x000000001111C000-memory.dmpFilesize
112KB
-
memory/4544-103-0x0000000010C90000-0x0000000010C9C000-memory.dmpFilesize
48KB
-
memory/4544-88-0x0000000010C70000-0x0000000010C78000-memory.dmpFilesize
32KB
-
memory/4544-202-0x0000000011300000-0x0000000011308000-memory.dmpFilesize
32KB
-
memory/4544-201-0x00000000112F0000-0x00000000112FA000-memory.dmpFilesize
40KB
-
memory/4544-325-0x0000000000400000-0x0000000000FD3000-memory.dmpFilesize
11.8MB
-
memory/4544-324-0x0000000012400000-0x0000000012432000-memory.dmpFilesize
200KB
-
memory/4544-311-0x0000000012390000-0x00000000123C0000-memory.dmpFilesize
192KB
-
memory/4544-298-0x00000000122E0000-0x00000000122EE000-memory.dmpFilesize
56KB
-
memory/4544-285-0x0000000011AC0000-0x0000000011ACE000-memory.dmpFilesize
56KB
-
memory/4544-272-0x0000000012330000-0x0000000012384000-memory.dmpFilesize
336KB
-
memory/4544-259-0x0000000011AB0000-0x0000000011ABA000-memory.dmpFilesize
40KB
-
memory/4544-339-0x00000000146D0000-0x00000000146E8000-memory.dmpFilesize
96KB
-
memory/4544-258-0x0000000011A20000-0x0000000011A28000-memory.dmpFilesize
32KB
-
memory/4544-386-0x0000000014960000-0x0000000014A74000-memory.dmpFilesize
1.1MB
-
memory/4544-373-0x0000000014830000-0x000000001483A000-memory.dmpFilesize
40KB
-
memory/4544-415-0x0000000000400000-0x0000000000FD3000-memory.dmpFilesize
11.8MB
-
memory/4544-414-0x0000000014870000-0x000000001487A000-memory.dmpFilesize
40KB
-
memory/4544-400-0x0000000014890000-0x00000000148B6000-memory.dmpFilesize
152KB
-
memory/4544-416-0x0000000000400000-0x0000000000FD3000-memory.dmpFilesize
11.8MB
-
memory/4544-417-0x0000000000400000-0x0000000000FD3000-memory.dmpFilesize
11.8MB
-
memory/4544-418-0x0000000000400000-0x0000000000FD3000-memory.dmpFilesize
11.8MB
-
memory/4544-463-0x0000000000400000-0x0000000000FD3000-memory.dmpFilesize
11.8MB
-
memory/4544-464-0x000000000089E000-0x0000000000FA1000-memory.dmpFilesize
7.0MB
-
memory/4544-465-0x0000000000400000-0x0000000000FD3000-memory.dmpFilesize
11.8MB
-
memory/4544-466-0x0000000000400000-0x0000000000FD3000-memory.dmpFilesize
11.8MB
-
memory/4544-511-0x0000000000400000-0x0000000000FD3000-memory.dmpFilesize
11.8MB
-
memory/4544-512-0x0000000000400000-0x0000000000FD3000-memory.dmpFilesize
11.8MB
-
memory/4544-513-0x0000000000400000-0x0000000000FD3000-memory.dmpFilesize
11.8MB
-
memory/4544-558-0x0000000000400000-0x0000000000FD3000-memory.dmpFilesize
11.8MB
-
memory/4544-559-0x0000000000400000-0x0000000000FD3000-memory.dmpFilesize
11.8MB