Analysis
- max time kernel
104s - max time network
104s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
07/09/2024, 02:31
General
- Target Rapihuyet.exe
- Size 7.3MB
- Sample240907-cz55cs1cqa
- SHA256 5971e773c29143d5c6c5a3af21f5d2b50c0c592b5780d62f60aea54acabfc6c8
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Obfuscated with Agile.Net obfuscator 15 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Rapihuyet.exe"C:\Users\Admin\AppData\Local\Temp\Rapihuyet.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
evbAB72.tmp
evbAD9B.tmp
memory/1960-0-0x0000000000090000-0x00000000013DE000-memory.dmp
memory/1960-1-0x00007FF9E300D000-0x00007FF9E300E000-memory.dmp
memory/1960-2-0x00007FF9E2F70000-0x00007FF9E3165000-memory.dmp
memory/1960-3-0x00007FF9E2F70000-0x00007FF9E3165000-memory.dmp
memory/1960-4-0x00007FF9E2F70000-0x00007FF9E3165000-memory.dmp
memory/1960-5-0x0000000000090000-0x00000000013DE000-memory.dmp
memory/1960-7-0x00007FF9E2F70000-0x00007FF9E3165000-memory.dmp
memory/1960-8-0x00007FF9E2F70000-0x00007FF9E3165000-memory.dmp
memory/1960-6-0x0000000000090000-0x00000000013DE000-memory.dmp
memory/1960-9-0x00007FF9E2F70000-0x00007FF9E3165000-memory.dmp
memory/1960-12-0x00007FF9E2F70000-0x00007FF9E3165000-memory.dmp
memory/1960-10-0x00007FF9E2F70000-0x00007FF9E3165000-memory.dmp
memory/1960-11-0x0000000000090000-0x00000000013DE000-memory.dmp
memory/1960-18-0x0000000005150000-0x0000000005196000-memory.dmp
memory/1960-19-0x0000000004D70000-0x0000000004D8A000-memory.dmp
memory/1960-20-0x00000000228F0000-0x0000000022912000-memory.dmp
memory/1960-13-0x0000000000090000-0x00000000013DE000-memory.dmp
memory/1960-21-0x00007FF9E2F70000-0x00007FF9E3165000-memory.dmp
memory/1960-22-0x0000000022920000-0x00000000229F0000-memory.dmp
memory/1960-27-0x0000000024BF0000-0x0000000024C3A000-memory.dmp
memory/1960-32-0x00000000051A0000-0x00000000051C0000-memory.dmp
memory/1960-37-0x00000000051F0000-0x000000000520E000-memory.dmp
memory/1960-42-0x00000000228C0000-0x00000000228DC000-memory.dmp
memory/1960-47-0x0000000024CA0000-0x0000000024CFA000-memory.dmp
memory/1960-52-0x0000000024C70000-0x0000000024C96000-memory.dmp
memory/1960-57-0x0000000024D00000-0x0000000024D1E000-memory.dmp
memory/1960-66-0x0000000028FC0000-0x0000000028FC8000-memory.dmp
memory/1960-72-0x0000000180000000-0x0000000180137000-memory.dmp
memory/1960-69-0x0000000180000000-0x0000000180137000-memory.dmp
memory/1960-77-0x0000000028EB0000-0x0000000028EBC000-memory.dmp
memory/1960-78-0x0000000000090000-0x00000000013DE000-memory.dmp
memory/1960-79-0x00007FF9E2F70000-0x00007FF9E3165000-memory.dmp
memory/1960-80-0x00007FF9E2F70000-0x00007FF9E3165000-memory.dmp
memory/1960-84-0x00007FF9E2F70000-0x00007FF9E3165000-memory.dmp
memory/1960-83-0x00007FF9E2F70000-0x00007FF9E3165000-memory.dmp
memory/1960-82-0x00007FF9E2F70000-0x00007FF9E3165000-memory.dmp
memory/1960-81-0x00007FF9E2F70000-0x00007FF9E3165000-memory.dmp
memory/1960-86-0x00000000229F0000-0x0000000022A5B000-memory.dmp
memory/1960-87-0x0000000180000000-0x0000000180137000-memory.dmp
memory/1960-85-0x0000000000090000-0x00000000013DE000-memory.dmp
memory/1960-88-0x00007FF9E2F70000-0x00007FF9E3165000-memory.dmp
memory/1960-89-0x0000000000090000-0x00000000013DE000-memory.dmp
memory/1960-92-0x0000000000090000-0x00000000013DE000-memory.dmp
memory/1960-95-0x0000000000090000-0x00000000013DE000-memory.dmp
memory/1960-98-0x0000000000090000-0x00000000013DE000-memory.dmp
memory/1960-101-0x0000000000090000-0x00000000013DE000-memory.dmp
memory/1960-104-0x0000000000090000-0x00000000013DE000-memory.dmp
memory/1960-107-0x0000000000090000-0x00000000013DE000-memory.dmp
memory/1960-110-0x0000000000090000-0x00000000013DE000-memory.dmp
memory/1960-113-0x0000000000090000-0x00000000013DE000-memory.dmp