Overview

overview

7

Static

static

3

Aragami V1...un.exe

windows7-x64

7

Aragami V1...un.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/09/2024, 18:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    Aragami V1.03 Trainer +3 MrAntiFun.exe

  • Size

    4.5MB

  • MD5

    f3438dd053a7ae8ad3e53301a3dbe332

  • SHA1

    2963301db0d10ed855e5e853377eb4629d891192

  • SHA256

    1c68ff9cf1aeb566c74093e03a3360a9c5329c3f1a04bf7b7827429387488408

  • SHA512

    d18bb468396bac023648f3e4d733691fa37a601fc4fc8415ad905ce749c175d32e23d750a3726803c5b89638d7d8e78e90fe74f738e49fd4ccf8dcf784e394c4

  • SSDEEP

    98304:g9i6VaN2JKc/vom18UvDQ6ZgXsNDeY9b:KiCpFZdLb

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 46 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Aragami V1.03 Trainer +3 MrAntiFun.exe
    "C:\Users\Admin\AppData\Local\Temp\Aragami V1.03 Trainer +3 MrAntiFun.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3708
    • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET62AD.tmp\Aragami V1.03 Trainer +3 MrAntiFun.exe
      "C:\Users\Admin\AppData\Local\Temp\cetrainers\CET62AD.tmp\Aragami V1.03 Trainer +3 MrAntiFun.exe" -ORIGIN:"C:\Users\Admin\AppData\Local\Temp\"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1912
      • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET62AD.tmp\extracted\Aragami V1.03 Trainer +3 MrAntiFun.exe
        "C:\Users\Admin\AppData\Local\Temp\cetrainers\CET62AD.tmp\extracted\Aragami V1.03 Trainer +3 MrAntiFun.exe" "C:\Users\Admin\AppData\Local\Temp\cetrainers\CET62AD.tmp\extracted\CET_TRAINER.CETRAINER" "-ORIGIN:C:\Users\Admin\AppData\Local\Temp\"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:5004
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4392,i,3861745594156495651,17595114179815238301,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:8
    1⤵
      PID:1248

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET62AD.tmp\Aragami V1.03 Trainer +3 MrAntiFun.exe
            Filesize

            193KB

            MD5

            6852660b8cbb67ee3f1e31bf2f1e0afd

            SHA1

            c1b790e062f3a13d3e2f90c58e92ded585abbe3b

            SHA256

            cd86234cf14dfc0e66ae9e575326fd0cf74723a5a60337f7079c0540b6da5c8b

            SHA512

            5722ebf6bef799721464094c6d6a81931bf8f78bdd1fbe12b153cf7b0e4e9e7307fa7a01e0cc16ce885c20c3a0a3cc95d6a7d86413f0c61cca3450fa565dd6a8

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET62AD.tmp\CET_Archive.dat
            Filesize

            4.1MB

            MD5

            ef8633cf2edf9fbdccfa350edb01f6c9

            SHA1

            3397d7586b1aab1142e95c2a9515322306158243

            SHA256

            98ba17af700a243c37ea977292c83e840df6f8f866ccf3ded8a0773ab51d76c5

            SHA512

            a015093eb993bcd4b66282fee131c11b193590c7ae4366317943b20a34864423b8412a2e5466ef9b8069d9c448d57a7258cc2cdd7c6635023da35aa2f7451e73

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET62AD.tmp\extracted\Aragami V1.03 Trainer +3 MrAntiFun.exe
            Filesize

            10.4MB

            MD5

            45996e41a50873d5dd6d37901ca3d4c5

            SHA1

            c851ee71e40ba498d76fb4a94ea514c7889a00ff

            SHA256

            a2558b4f3bb16ecc13fe69a697b24d72ee2e893f8b692c09e9b38720ddef7301

            SHA512

            f2fd316593fb08ae22ea1b2c5ca4a8ad58034bb41e613363c8c2cb318a551f858ec9502c45f7f30398bef5e9fcdf48a3b90982dce5c22c0f71cf80b7ccc36ad5

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET62AD.tmp\extracted\CET_TRAINER.CETRAINER
            Filesize

            514KB

            MD5

            0ea4b6721965d0d5d713fef04f133fa6

            SHA1

            298c071261b172d197a31cc8e5716ab7eb581f26

            SHA256

            0a0f27c5ef625539e6e20b5dbcf10a64d2b329de91a542cd4491cffb07fdc9a4

            SHA512

            9f727d94160632f0f40a3778ccc1a31e335789ba5abc876da80132eb22051477c23adf8c51f84841e5de747e227523f416260cf70f4ef21f483799a8eb93849a

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET62AD.tmp\extracted\defines.lua
            Filesize

            5KB

            MD5

            1dc41a0a351e745085fcc98a3933d91f

            SHA1

            bf1e7d333e6d7b3d4bfe5cdcada19af1931dbe15

            SHA256

            a2e02dd32f0245ff31190288b368b3efbbe7c48a95dd22c321231c2f46597d9b

            SHA512

            76f171411d028e72613859332f381f8f26e85d1844c143a8888e4937ca72d7b38ffe66ce617eee5e8155ba034dcc559a9417b5def056bb74227b9bae392d1440

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\cetrainers\CET62AD.tmp\extracted\lua53-64.dll
            Filesize

            500KB

            MD5

            476cbd8e116ef838a0b161100ff744be

            SHA1

            72a6b00754ff4a1a6f2bbb75fbce9d2fdd475e81

            SHA256

            c33f2e8ba61e5517b2598d7920b672326ff117ed5a5bdcddc125c6a5a328886e

            SHA512

            b12dee6fdc493bdc7e65d446433d942802c79564f6a1f56a1c1a7e2e3f76d270af9e3d162d368fa82d314a37d98fef1569bf90f275b0e059ca0eca49c56086d8

            Download Submit

          • memory/5004-17-0x0000000008000000-0x0000000008001000-memory.dmp

            Filesize

            4KB

            Download

          • memory/5004-19-0x0000000008000000-0x0000000008001000-memory.dmp

            Filesize

            4KB

            Download