Analysis
-
max time kernel
26s -
max time network
15s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
11-06-2024 05:48
Behavioral task
behavioral1
Sample
VЕGАS Prо.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
VЕGАS Prо.exe
Resource
win11-20240426-en
General
-
Target
VЕGАS Prо.exe
-
Size
101.7MB
-
MD5
cd5df5f6e86bdd5408d11b6204053c21
-
SHA1
ea20629b9db077aa6bfe46e16bd22bfdc580d380
-
SHA256
56f44707456eb8cfd4d7ab6c63c62015515a4a6154ff5e92e92e576b133003d1
-
SHA512
bf57afe5f6aa6a4affb3bb0a805399eda06d07e170a1d09804cf9b190f53a81d14bea07e421d0991c514e22af3a55077d3d8bf2eb5b7f12b7ad2725c9778448c
-
SSDEEP
1572864:GRWWlH8DHsD6tzKii6a3/1pY1rSVhFIYUT/zdylJMos/hhQ147FyixHX0w:GwHO53DTFIYUTZyl5ohQrMj
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
VЕGАSPrо.EXEpid process 1424 VЕGАSPrо.EXE -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/4584-1-0x0000000000170000-0x0000000001170000-memory.dmp agile_net -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
VЕGАS Prо.exedescription pid process Token: SeDebugPrivilege 4584 VЕGАS Prо.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
VЕGАS Prо.exedescription pid process target process PID 4584 wrote to memory of 1424 4584 VЕGАS Prо.exe VЕGАSPrо.EXE PID 4584 wrote to memory of 1424 4584 VЕGАS Prо.exe VЕGАSPrо.EXE
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4584-0-0x00000000748FE000-0x00000000748FF000-memory.dmpFilesize
4KB
-
memory/4584-1-0x0000000000170000-0x0000000001170000-memory.dmpFilesize
16.0MB
-
memory/4584-2-0x000000000B040000-0x000000000B0A6000-memory.dmpFilesize
408KB
-
memory/4584-3-0x00000000748F0000-0x00000000750A1000-memory.dmpFilesize
7.7MB
-
memory/4584-4-0x000000002FCE0000-0x0000000030CE0000-memory.dmpFilesize
16.0MB
-
memory/4584-5-0x0000000008AB0000-0x0000000008AD6000-memory.dmpFilesize
152KB
-
memory/4584-6-0x00000000128F0000-0x0000000012966000-memory.dmpFilesize
472KB
-
memory/4584-7-0x000000000B190000-0x000000000B19A000-memory.dmpFilesize
40KB
-
memory/4584-8-0x000000000FFA0000-0x000000000FFBE000-memory.dmpFilesize
120KB
-
memory/4584-20-0x00000000748F0000-0x00000000750A1000-memory.dmpFilesize
7.7MB