Analysis
- max time kernel
147s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
26/06/2024, 16:56
General
- Target AimBolt.exe
- Size 761KB
- Sample240626-vfnp3stdjc
- SHA256 2bd9aaefd640dd2ff0afcc994ebf0b66f7b5ebb05fd38d78ef04815e901b4994
Malware Config
Signatures
- Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious use of NtSetInformationThreadHideFromDebugger 25 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AimBolt.exe"C:\Users\Admin\AppData\Local\Temp\AimBolt.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
4E36753A.dll
memory/3080-6-0x000001AAA6360000-0x000001AAA64B0000-memory.dmp
memory/3080-12-0x00007FFA4C3A0000-0x00007FFA4CE61000-memory.dmp
memory/3080-0-0x00007FFA4C3A3000-0x00007FFA4C3A5000-memory.dmp
memory/3080-8-0x000001AA8BFD0000-0x000001AA8BFD6000-memory.dmp
memory/3080-9-0x00007FFA4C3A0000-0x00007FFA4CE61000-memory.dmp
memory/3080-1-0x000001AA8BB60000-0x000001AA8BC26000-memory.dmp
memory/3080-11-0x00007FFA4C3A0000-0x00007FFA4CE61000-memory.dmp
memory/3080-4-0x00007FFA4C3A0000-0x00007FFA4CE61000-memory.dmp
memory/3080-13-0x000001AA8C060000-0x000001AA8C066000-memory.dmp
memory/3080-14-0x000001AA8D860000-0x000001AA8D87A000-memory.dmp
memory/3080-15-0x000001AAA6310000-0x000001AAA6322000-memory.dmp
memory/3080-16-0x00007FFA4C3A0000-0x00007FFA4CE61000-memory.dmp
memory/3080-17-0x00007FFA4C3A0000-0x00007FFA4CE61000-memory.dmp
memory/3080-18-0x00007FFA4C3A0000-0x00007FFA4CE61000-memory.dmp