Analysis Overview
SHA256
6ff53b8187d0d3e287ad9ce3da20eca4f9dd105a2e3421ca1ad73b533ec4b91a
Threat Level: Shows suspicious behavior
The file Ambrosial.exe was found to be: Shows suspicious behavior.
Malicious Activity Summary
Loads dropped DLL
Obfuscated with Agile.Net obfuscator
Legitimate hosting services abused for malware hosting/C2
Drops file in Windows directory
Unsigned PE
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-09-17 20:17
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-09-17 20:17
Reported
2024-09-17 20:20
Platform
win7-20240903-en
Max time kernel
121s
Max time network
122s
Command Line
Signatures
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\Fonts\Azonix.otf | C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe | N/A |
| File opened for modification | C:\Windows\Fonts\Azonix.otf | C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3004 wrote to memory of 2432 | N/A | C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe | C:\Windows\system32\WerFault.exe |
| PID 3004 wrote to memory of 2432 | N/A | C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe | C:\Windows\system32\WerFault.exe |
| PID 3004 wrote to memory of 2432 | N/A | C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe | C:\Windows\system32\WerFault.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe
"C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe"
C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3004 -s 596
Network
Files
memory/3004-0-0x000007FEF5623000-0x000007FEF5624000-memory.dmp
memory/3004-1-0x0000000001050000-0x000000000203A000-memory.dmp
memory/3004-3-0x0000000000C30000-0x0000000000C4A000-memory.dmp
memory/3004-4-0x000007FEF5620000-0x000007FEF600C000-memory.dmp
memory/3004-2-0x0000000000C10000-0x0000000000C2C000-memory.dmp
C:\Windows\Fonts\Azonix.otf
| MD5 | cdfe47b31e9184a55cf02eef1baf7240 |
| SHA1 | b8825c605434d572f5277be0283d5a9b2cde59e4 |
| SHA256 | 51a65e5c09bf27980adf640cb54cb2a5bbb217fdaab79b377e158f92533362a9 |
| SHA512 | a2e5141c0f7ca72bcf5b1a303fce1734953d83ad363d4c3c7d8786e1bfd872a6b96eeabce3740b547a5447e255415cdf688a0d2074cecfaa0c54c49d0f2882c5 |
memory/3004-11-0x000007FEF5623000-0x000007FEF5624000-memory.dmp
memory/3004-12-0x000007FEF5620000-0x000007FEF600C000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-09-17 20:17
Reported
2024-09-17 20:17
Platform
win10v2004-20240802-en
Max time kernel
14s
Max time network
15s
Command Line
Signatures
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe | N/A |
Obfuscated with Agile.Net obfuscator
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | raw.githubusercontent.com | N/A | N/A |
| N/A | raw.githubusercontent.com | N/A | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\Fonts\Azonix.otf | C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe | N/A |
| File opened for modification | C:\Windows\Fonts\Azonix.otf | C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe | N/A |
| File created | C:\Windows\Fonts\OpenSansLight.ttf | C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe
"C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | raw.githubusercontent.com | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 185.199.110.133:443 | raw.githubusercontent.com | tcp |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 162.159.130.233:443 | cdn.discordapp.com | tcp |
| US | 8.8.8.8:53 | picsum.photos | udp |
| US | 8.8.8.8:53 | 25.140.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 134.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.110.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 233.130.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 104.26.4.30:443 | picsum.photos | tcp |
| US | 8.8.8.8:53 | fastly.picsum.photos | udp |
| US | 151.101.65.91:443 | fastly.picsum.photos | tcp |
| US | 8.8.8.8:53 | 91.65.101.151.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 30.4.26.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
Files
memory/4700-0-0x00007FFBCA443000-0x00007FFBCA445000-memory.dmp
memory/4700-1-0x000002C61F510000-0x000002C6204FA000-memory.dmp
memory/4700-2-0x000002C620910000-0x000002C62092C000-memory.dmp
memory/4700-3-0x000002C620950000-0x000002C62096A000-memory.dmp
memory/4700-5-0x00007FFBCA440000-0x00007FFBCAF01000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Azonix.otf
| MD5 | cdfe47b31e9184a55cf02eef1baf7240 |
| SHA1 | b8825c605434d572f5277be0283d5a9b2cde59e4 |
| SHA256 | 51a65e5c09bf27980adf640cb54cb2a5bbb217fdaab79b377e158f92533362a9 |
| SHA512 | a2e5141c0f7ca72bcf5b1a303fce1734953d83ad363d4c3c7d8786e1bfd872a6b96eeabce3740b547a5447e255415cdf688a0d2074cecfaa0c54c49d0f2882c5 |
C:\Windows\Fonts\OpenSansLight.ttf
| MD5 | 1bf71be111189e76987a4bb9b3115cb7 |
| SHA1 | 40442c189568184b6e6c27a25d69f14d91b65039 |
| SHA256 | cf5f5184c1441a1660aa52526328e9d5c2793e77b6d8d3a3ad654bdb07ab8424 |
| SHA512 | cb18b69e98a194af5e3e3d982a75254f3a20bd94c68816a15f38870b9be616cef0c32033f253219cca9146b2b419dd6df28cc4ceeff80d01f400aa0ed101e061 |
memory/4700-26-0x000002C63B0D0000-0x000002C63B180000-memory.dmp
memory/4700-34-0x000002C63AAD0000-0x000002C63AAF2000-memory.dmp
C:\Users\Admin\AppData\Local\Ambrosial\log.txt
| MD5 | 55ddfe7c740b3cb5e093e5a006a30f82 |
| SHA1 | e94dbead8f7717b5400a30b1efdd755b6a824a22 |
| SHA256 | 0491be9b3100d69e4e317225ad3278c1aa2fe6410a5c206d621817938b684f8f |
| SHA512 | dcce0b4976f5aba575ecdf630b95e2b31a96d083a923d86118ae4042c18a2e909c126887a3c8eebf5e5036ce8ec347ad96e18bc7e75ec71d42c9ca53d10172c1 |
C:\Users\Admin\AppData\Local\Ambrosial\log.txt
| MD5 | 39e612c2b5c7aace7f6e1d1c1b09932c |
| SHA1 | 9dfb34919c3e7051cf1d1eb259f837341d294dec |
| SHA256 | 4bc96cfd8a0f1dd69a144da8cb5348c7632e7588fb4d333b013b888e3fbe4b79 |
| SHA512 | bb5f02cc87b568046c4ca6fc77fb4d7b48fb4c9e1ebe8f151df5908ec73484ab560eeba825fa9f7c94ef3fb00f4e79d416f91c720f293209f6655bc04b0c0019 |
memory/4700-167-0x00007FFBCA443000-0x00007FFBCA445000-memory.dmp
memory/4700-185-0x00007FFBCA440000-0x00007FFBCAF01000-memory.dmp
memory/4700-262-0x000002C63B610000-0x000002C63B7F8000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\0e1a63fc-9228-4b4f-96fc-fee060f96e92\GunaDotNetRT64.dll
| MD5 | 9c43f77cb7cff27cb47ed67babe3eda5 |
| SHA1 | b0400cf68249369d21de86bd26bb84ccffd47c43 |
| SHA256 | f25b9288fe370dcfcb4823fb4e44ab88c7f5fce6e137d0dba389a3dba07d621e |
| SHA512 | cde6fb6cf8db6f9746e69e6c10214e60b3646700d70b49668a2a792e309714dd2d4c5a5241977a833a95fcde8318abcc89eb9968a5039a0b75726bbfa27125a7 |
memory/4700-269-0x00007FFBC54F0000-0x00007FFBC5517000-memory.dmp
memory/4700-284-0x000002C63B610000-0x000002C63B7F4000-memory.dmp
memory/4700-310-0x000002C63B610000-0x000002C63B7F4000-memory.dmp
memory/4700-330-0x000002C63B610000-0x000002C63B7F4000-memory.dmp