Analysis Overview
SHA256
6ff53b8187d0d3e287ad9ce3da20eca4f9dd105a2e3421ca1ad73b533ec4b91a
Threat Level: Shows suspicious behavior
The file Ambrosial.exe was found to be: Shows suspicious behavior.
Malicious Activity Summary
Obfuscated with Agile.Net obfuscator
Legitimate hosting services abused for malware hosting/C2
Drops file in Windows directory
Unsigned PE
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-09-27 01:59
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-09-27 01:59
Reported
2024-09-27 02:01
Platform
win7-20240903-en
Max time kernel
117s
Max time network
119s
Command Line
Signatures
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\Fonts\Azonix.otf | C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe | N/A |
| File opened for modification | C:\Windows\Fonts\Azonix.otf | C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2428 wrote to memory of 2920 | N/A | C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe | C:\Windows\system32\WerFault.exe |
| PID 2428 wrote to memory of 2920 | N/A | C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe | C:\Windows\system32\WerFault.exe |
| PID 2428 wrote to memory of 2920 | N/A | C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe | C:\Windows\system32\WerFault.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe
"C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe"
C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2428 -s 592
Network
Files
memory/2428-0-0x000007FEF5703000-0x000007FEF5704000-memory.dmp
memory/2428-1-0x0000000000E20000-0x0000000001E0A000-memory.dmp
memory/2428-3-0x00000000005E0000-0x00000000005FA000-memory.dmp
memory/2428-2-0x00000000005C0000-0x00000000005DC000-memory.dmp
memory/2428-4-0x000007FEF5700000-0x000007FEF60EC000-memory.dmp
C:\Windows\Fonts\Azonix.otf
| MD5 | cdfe47b31e9184a55cf02eef1baf7240 |
| SHA1 | b8825c605434d572f5277be0283d5a9b2cde59e4 |
| SHA256 | 51a65e5c09bf27980adf640cb54cb2a5bbb217fdaab79b377e158f92533362a9 |
| SHA512 | a2e5141c0f7ca72bcf5b1a303fce1734953d83ad363d4c3c7d8786e1bfd872a6b96eeabce3740b547a5447e255415cdf688a0d2074cecfaa0c54c49d0f2882c5 |
memory/2428-11-0x000007FEF5703000-0x000007FEF5704000-memory.dmp
memory/2428-12-0x000007FEF5700000-0x000007FEF60EC000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-09-27 01:59
Reported
2024-09-27 01:59
Platform
win10v2004-20240802-en
Max time kernel
10s
Max time network
12s
Command Line
Signatures
Obfuscated with Agile.Net obfuscator
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | raw.githubusercontent.com | N/A | N/A |
| N/A | raw.githubusercontent.com | N/A | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\Fonts\Azonix.otf | C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe | N/A |
| File opened for modification | C:\Windows\Fonts\Azonix.otf | C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe | N/A |
| File created | C:\Windows\Fonts\OpenSansLight.ttf | C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe | N/A |
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 | C:\Windows\system32\taskmgr.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A | C:\Windows\system32\taskmgr.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName | C:\Windows\system32\taskmgr.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| Token: SeCreateGlobalPrivilege | N/A | C:\Windows\system32\taskmgr.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe
"C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe"
C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | raw.githubusercontent.com | udp |
| US | 185.199.108.133:443 | raw.githubusercontent.com | tcp |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 162.159.135.233:443 | cdn.discordapp.com | tcp |
| US | 8.8.8.8:53 | picsum.photos | udp |
| US | 104.26.5.30:443 | picsum.photos | tcp |
| US | 8.8.8.8:53 | 133.108.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 233.135.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | fastly.picsum.photos | udp |
| US | 151.101.129.91:443 | fastly.picsum.photos | tcp |
| US | 8.8.8.8:53 | 30.5.26.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 91.129.101.151.in-addr.arpa | udp |
Files
memory/3844-0-0x00007FF8F2953000-0x00007FF8F2955000-memory.dmp
memory/3844-1-0x000001203A950000-0x000001203B93A000-memory.dmp
memory/3844-2-0x000001203BCE0000-0x000001203BCFC000-memory.dmp
memory/3844-3-0x000001203D4E0000-0x000001203D4FA000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Azonix.otf
| MD5 | cdfe47b31e9184a55cf02eef1baf7240 |
| SHA1 | b8825c605434d572f5277be0283d5a9b2cde59e4 |
| SHA256 | 51a65e5c09bf27980adf640cb54cb2a5bbb217fdaab79b377e158f92533362a9 |
| SHA512 | a2e5141c0f7ca72bcf5b1a303fce1734953d83ad363d4c3c7d8786e1bfd872a6b96eeabce3740b547a5447e255415cdf688a0d2074cecfaa0c54c49d0f2882c5 |
memory/3844-20-0x00007FF8F2950000-0x00007FF8F3411000-memory.dmp
C:\Windows\Fonts\OpenSansLight.ttf
| MD5 | 1bf71be111189e76987a4bb9b3115cb7 |
| SHA1 | 40442c189568184b6e6c27a25d69f14d91b65039 |
| SHA256 | cf5f5184c1441a1660aa52526328e9d5c2793e77b6d8d3a3ad654bdb07ab8424 |
| SHA512 | cb18b69e98a194af5e3e3d982a75254f3a20bd94c68816a15f38870b9be616cef0c32033f253219cca9146b2b419dd6df28cc4ceeff80d01f400aa0ed101e061 |
memory/3844-27-0x00000120563E0000-0x0000012056490000-memory.dmp
memory/3844-34-0x0000012055E00000-0x0000012055E22000-memory.dmp
C:\Users\Admin\AppData\Local\Ambrosial\log.txt
| MD5 | f905d4c09d7c49751233c86fde179603 |
| SHA1 | 882bcbaeeacbee68dfbeab456ed98d15d94a56ee |
| SHA256 | 82291c1fa983603f9348b2c30b1ec133a99924a9f97a95066f10367091168575 |
| SHA512 | 9162c40b453204b4f46e989881067399727db4600a700b34e6ddbf02c31fa0f824c381e8a64224261fec28416c32645398c65dfb8e02d1db7a4f8d387bb23cf3 |
memory/3844-220-0x00007FF8F2953000-0x00007FF8F2955000-memory.dmp
memory/3800-263-0x000001D0FA530000-0x000001D0FA531000-memory.dmp
memory/3800-262-0x000001D0FA530000-0x000001D0FA531000-memory.dmp
memory/3800-260-0x000001D0FA530000-0x000001D0FA531000-memory.dmp
memory/3800-272-0x000001D0FA530000-0x000001D0FA531000-memory.dmp
memory/3800-273-0x000001D0FA530000-0x000001D0FA531000-memory.dmp
memory/3800-267-0x000001D0FA530000-0x000001D0FA531000-memory.dmp
memory/3844-274-0x0000012056C00000-0x0000012056DE8000-memory.dmp
memory/3800-271-0x000001D0FA530000-0x000001D0FA531000-memory.dmp
memory/3800-270-0x000001D0FA530000-0x000001D0FA531000-memory.dmp
memory/3800-269-0x000001D0FA530000-0x000001D0FA531000-memory.dmp
memory/3800-268-0x000001D0FA530000-0x000001D0FA531000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\0e1a63fc-9228-4b4f-96fc-fee060f96e92\GunaDotNetRT64.dll
| MD5 | 9c43f77cb7cff27cb47ed67babe3eda5 |
| SHA1 | b0400cf68249369d21de86bd26bb84ccffd47c43 |
| SHA256 | f25b9288fe370dcfcb4823fb4e44ab88c7f5fce6e137d0dba389a3dba07d621e |
| SHA512 | cde6fb6cf8db6f9746e69e6c10214e60b3646700d70b49668a2a792e309714dd2d4c5a5241977a833a95fcde8318abcc89eb9968a5039a0b75726bbfa27125a7 |
memory/3844-293-0x0000012056C00000-0x0000012056DE4000-memory.dmp
memory/3844-283-0x0000012056C00000-0x0000012056DE4000-memory.dmp
memory/3844-281-0x00007FF901B90000-0x00007FF901CDE000-memory.dmp
memory/3844-295-0x0000012056C00000-0x0000012056DE4000-memory.dmp
memory/3844-315-0x0000012056C00000-0x0000012056DE4000-memory.dmp
memory/3844-311-0x0000012056C00000-0x0000012056DE4000-memory.dmp
memory/3844-297-0x0000012056C00000-0x0000012056DE4000-memory.dmp
memory/3844-292-0x0000012056C00000-0x0000012056DE4000-memory.dmp
memory/3844-289-0x0000012056C00000-0x0000012056DE4000-memory.dmp
memory/3844-287-0x0000012056C00000-0x0000012056DE4000-memory.dmp
memory/3844-285-0x0000012056C00000-0x0000012056DE4000-memory.dmp
memory/3844-282-0x0000012056C00000-0x0000012056DE4000-memory.dmp
memory/3844-299-0x0000012056C00000-0x0000012056DE4000-memory.dmp
memory/3844-323-0x0000012056C00000-0x0000012056DE4000-memory.dmp
memory/3844-333-0x00007FF8EB7A0000-0x00007FF8EB7C7000-memory.dmp
memory/3844-335-0x0000012056C00000-0x0000012056DE4000-memory.dmp
memory/3844-331-0x0000012056C00000-0x0000012056DE4000-memory.dmp
memory/3844-332-0x00007FF8F2950000-0x00007FF8F3411000-memory.dmp
memory/3844-329-0x0000012056C00000-0x0000012056DE4000-memory.dmp
memory/3844-327-0x0000012056C00000-0x0000012056DE4000-memory.dmp
memory/3844-325-0x0000012056C00000-0x0000012056DE4000-memory.dmp
memory/3844-321-0x0000012056C00000-0x0000012056DE4000-memory.dmp
memory/3844-320-0x0000012056C00000-0x0000012056DE4000-memory.dmp
memory/3844-317-0x0000012056C00000-0x0000012056DE4000-memory.dmp
memory/3844-313-0x0000012056C00000-0x0000012056DE4000-memory.dmp
memory/3844-309-0x0000012056C00000-0x0000012056DE4000-memory.dmp
memory/3844-307-0x0000012056C00000-0x0000012056DE4000-memory.dmp
memory/3844-305-0x0000012056C00000-0x0000012056DE4000-memory.dmp
memory/3844-303-0x0000012056C00000-0x0000012056DE4000-memory.dmp
memory/3844-301-0x0000012056C00000-0x0000012056DE4000-memory.dmp
memory/3844-3462-0x00007FF8EB7A0000-0x00007FF8EB7C7000-memory.dmp