56f44707456eb8cfd4d7ab6c63c62015515a4a6154ff5e92e92e576b133003d1

Analysis

max time kernel
26s
max time network
15s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
11-06-2024 05:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VЕGАS Prо.exe
Size

101.7MB
MD5

cd5df5f6e86bdd5408d11b6204053c21
SHA1

ea20629b9db077aa6bfe46e16bd22bfdc580d380
SHA256

56f44707456eb8cfd4d7ab6c63c62015515a4a6154ff5e92e92e576b133003d1
SHA512

bf57afe5f6aa6a4affb3bb0a805399eda06d07e170a1d09804cf9b190f53a81d14bea07e421d0991c514e22af3a55077d3d8bf2eb5b7f12b7ad2725c9778448c
SSDEEP

1572864:GRWWlH8DHsD6tzKii6a3/1pY1rSVhFIYUT/zdylJMos/hhQ147FyixHX0w:GwHO53DTFIYUTZyl5ohQrMj

Score

7^/10

agilenet

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

VЕGАSPrо.EXE

pid process

1424 VЕGАSPrо.EXE

pid	process
1424	VЕGАSPrо.EXE

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral2/memory/4584-1-0x0000000000170000-0x0000000001170000-memory.dmp	agile_net

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

VЕGАS Prо.exe

description pid process

Token: SeDebugPrivilege 4584 VЕGАS Prо.exe

description	pid	process
Token: SeDebugPrivilege	4584	VЕGАS Prо.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

VЕGАS Prо.exe

description	pid	process	target process
PID 4584 wrote to memory of 1424	4584	VЕGАS Prо.exe	VЕGАSPrо.EXE
PID 4584 wrote to memory of 1424	4584	VЕGАS Prо.exe	VЕGАSPrо.EXE

C:\Users\Admin\AppData\Local\Temp\VЕGАS Prо.exe
"C:\Users\Admin\AppData\Local\Temp\VЕGАS Prо.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4584

C:\Windows\Temp\VЕGАSPrо.EXE
"C:\Windows\Temp\VЕGАSPrо.EXE"
2⤵
- Executes dropped EXE
PID:1424

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4584-0-0x00000000748FE000-0x00000000748FF000-memory.dmp

Filesize
4KB

Download
memory/4584-1-0x0000000000170000-0x0000000001170000-memory.dmp

Filesize
16.0MB

Download
memory/4584-2-0x000000000B040000-0x000000000B0A6000-memory.dmp

Filesize
408KB

Download
memory/4584-3-0x00000000748F0000-0x00000000750A1000-memory.dmp

Filesize
7.7MB

Download
memory/4584-4-0x000000002FCE0000-0x0000000030CE0000-memory.dmp

Filesize
16.0MB

Download
memory/4584-5-0x0000000008AB0000-0x0000000008AD6000-memory.dmp

Filesize
152KB

Download
memory/4584-6-0x00000000128F0000-0x0000000012966000-memory.dmp

Filesize
472KB

Download
memory/4584-7-0x000000000B190000-0x000000000B19A000-memory.dmp

Filesize
40KB

Download
memory/4584-8-0x000000000FFA0000-0x000000000FFBE000-memory.dmp

Filesize
120KB

Download
memory/4584-20-0x00000000748F0000-0x00000000750A1000-memory.dmp

Filesize
7.7MB

Download