Analysis
- max time kernel
93s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
03/07/2024, 14:28
General
- Target 1685747712.exe
- Size 4.1MB
- Sample240703-rtahtsvbnj
- SHA256 2601b2ff8516a8e5d660e46187165c4ade1adfcaf182074a7414f2afe3af2f4c
Malware Config
Signatures
- Obfuscated with Agile.Net obfuscator 19 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1685747712.exe"C:\Users\Admin\AppData\Local\Temp\1685747712.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3216-1-0x0000000002D60000-0x0000000002D9F000-memory.dmp
memory/3216-0-0x0000000000400000-0x0000000000C89000-memory.dmp
memory/3216-2-0x00000000007D4000-0x0000000000C58000-memory.dmp
memory/3216-5-0x0000000000EE0000-0x0000000000EE1000-memory.dmp
memory/3216-4-0x0000000002D60000-0x0000000002D9F000-memory.dmp
memory/3216-3-0x0000000000400000-0x0000000000C89000-memory.dmp
memory/3216-7-0x0000000000400000-0x0000000000C89000-memory.dmp
memory/3216-6-0x0000000075A40000-0x0000000075C55000-memory.dmp
memory/3216-8-0x00000000767C0000-0x0000000076A41000-memory.dmp
memory/3216-9-0x0000000000400000-0x0000000000C89000-memory.dmp
memory/3216-10-0x0000000076650000-0x0000000076733000-memory.dmp
memory/3216-11-0x0000000000400000-0x0000000000C89000-memory.dmp
memory/3216-12-0x0000000073A30000-0x0000000073AB9000-memory.dmp
memory/3216-13-0x0000000000400000-0x0000000000C89000-memory.dmp
memory/3216-14-0x0000000000400000-0x0000000000C89000-memory.dmp
memory/3216-15-0x0000000006490000-0x0000000006878000-memory.dmp
memory/3216-16-0x0000000006880000-0x0000000006B44000-memory.dmp
memory/3216-17-0x0000000006C80000-0x0000000006D99000-memory.dmp
memory/3216-18-0x0000000000400000-0x0000000000C89000-memory.dmp
memory/3216-19-0x0000000006C80000-0x0000000006D99000-memory.dmp
memory/3216-20-0x0000000006C80000-0x0000000006D99000-memory.dmp
memory/3216-31-0x0000000010000000-0x0000000010005000-memory.dmp
memory/3216-40-0x0000000010000000-0x0000000010005000-memory.dmp
memory/3216-37-0x0000000010000000-0x0000000010005000-memory.dmp
memory/3216-34-0x0000000010000000-0x0000000010005000-memory.dmp
memory/3216-29-0x0000000010000000-0x0000000010005000-memory.dmp
memory/3216-43-0x0000000076ED0000-0x0000000077483000-memory.dmp
memory/3216-44-0x0000000000400000-0x0000000000C89000-memory.dmp
memory/3216-45-0x0000000000400000-0x0000000000C89000-memory.dmp
memory/3216-46-0x000000000A040000-0x000000000A5E4000-memory.dmp
memory/3216-48-0x0000000000400000-0x0000000000C89000-memory.dmp
memory/3216-47-0x000000000A5F0000-0x000000000A682000-memory.dmp
memory/3216-49-0x0000000000400000-0x0000000000C89000-memory.dmp
memory/3216-50-0x0000000000400000-0x0000000000C89000-memory.dmp
memory/3216-56-0x0000000009910000-0x000000000991A000-memory.dmp
memory/3216-66-0x000000000A710000-0x000000000A71A000-memory.dmp
memory/3216-53-0x0000000009910000-0x000000000991A000-memory.dmp
memory/3216-51-0x0000000009910000-0x000000000991A000-memory.dmp
memory/3216-67-0x0000000000400000-0x0000000000C89000-memory.dmp
memory/3216-68-0x0000000000400000-0x0000000000C89000-memory.dmp
memory/3216-69-0x0000000000400000-0x0000000000C89000-memory.dmp
memory/3216-70-0x0000000000400000-0x0000000000C89000-memory.dmp
memory/3216-72-0x0000000000400000-0x0000000000C89000-memory.dmp
memory/3216-73-0x0000000006C80000-0x0000000006D99000-memory.dmp
memory/3216-84-0x0000000002D60000-0x0000000002D9F000-memory.dmp
memory/3216-85-0x0000000000400000-0x0000000000C89000-memory.dmp
memory/3216-86-0x0000000075A40000-0x0000000075C55000-memory.dmp
memory/3216-87-0x0000000076530000-0x0000000076554000-memory.dmp
memory/3216-122-0x00000000007D4000-0x0000000000C58000-memory.dmp