Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
21/07/2024, 01:25
General
- Target b67e78fab54517f697450665948373f659436a7899e1cad5d19024b0a45ccec6.exe
- Size 2.9MB
- Sample240721-bs2b6atgrj
- SHA256 b67e78fab54517f697450665948373f659436a7899e1cad5d19024b0a45ccec6
Malware Config
Signatures
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Program crash 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b67e78fab54517f697450665948373f659436a7899e1cad5d19024b0a45ccec6.exe"C:\Users\Admin\AppData\Local\Temp\b67e78fab54517f697450665948373f659436a7899e1cad5d19024b0a45ccec6.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 11042⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5024 -ip 50241⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5024-0-0x000000007487E000-0x000000007487F000-memory.dmp
memory/5024-1-0x0000000000380000-0x000000000066A000-memory.dmp
memory/5024-2-0x0000000004F60000-0x0000000004F7A000-memory.dmp
memory/5024-3-0x0000000005140000-0x000000000543C000-memory.dmp
memory/5024-4-0x0000000074870000-0x0000000075020000-memory.dmp
memory/5024-5-0x0000000005750000-0x00000000057EC000-memory.dmp
memory/5024-6-0x0000000006920000-0x0000000006BCC000-memory.dmp
memory/5024-7-0x00000000057F0000-0x0000000005BE4000-memory.dmp
memory/5024-8-0x0000000006190000-0x0000000006734000-memory.dmp
memory/5024-9-0x0000000008440000-0x0000000008A58000-memory.dmp
memory/5024-10-0x0000000005C80000-0x0000000005D12000-memory.dmp
memory/5024-11-0x0000000005730000-0x0000000005742000-memory.dmp
memory/5024-12-0x0000000005BE0000-0x0000000005BFE000-memory.dmp
memory/5024-13-0x0000000074870000-0x0000000075020000-memory.dmp