Analysis Overview
SHA256
6ff53b8187d0d3e287ad9ce3da20eca4f9dd105a2e3421ca1ad73b533ec4b91a
Threat Level: Shows suspicious behavior
The file Ambrosial.exe was found to be: Shows suspicious behavior.
Malicious Activity Summary
Obfuscated with Agile.Net obfuscator
Loads dropped DLL
Legitimate hosting services abused for malware hosting/C2
Drops file in Windows directory
Unsigned PE
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-12-27 14:22
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-12-27 14:22
Reported
2024-12-27 14:37
Platform
win11-20241007-en
Max time kernel
883s
Max time network
446s
Command Line
Signatures
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe | N/A |
Obfuscated with Agile.Net obfuscator
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | raw.githubusercontent.com | N/A | N/A |
| N/A | raw.githubusercontent.com | N/A | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\Fonts\Azonix.otf | C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe | N/A |
| File opened for modification | C:\Windows\Fonts\Azonix.otf | C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe | N/A |
| File created | C:\Windows\Fonts\OpenSansLight.ttf | C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe
"C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | raw.githubusercontent.com | udp |
| US | 185.199.111.133:443 | raw.githubusercontent.com | tcp |
| US | 8.8.8.8:53 | 133.111.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 162.159.135.233:443 | cdn.discordapp.com | tcp |
| US | 104.26.5.30:443 | picsum.photos | tcp |
| US | 151.101.193.91:443 | fastly.picsum.photos | tcp |
| GB | 95.101.143.193:443 | tcp | |
| GB | 95.101.143.193:443 | tcp | |
| US | 95.100.195.169:443 | r.bing.com | tcp |
| US | 95.100.195.169:443 | r.bing.com | tcp |
| US | 95.100.195.169:443 | r.bing.com | tcp |
| US | 95.100.195.169:443 | r.bing.com | tcp |
| US | 95.100.195.169:443 | r.bing.com | tcp |
| US | 95.100.195.169:443 | r.bing.com | tcp |
| US | 52.168.112.66:443 | browser.pipe.aria.microsoft.com | tcp |
Files
memory/3160-0-0x00007FFDD1B53000-0x00007FFDD1B55000-memory.dmp
memory/3160-1-0x000002801ECB0000-0x000002801FC9A000-memory.dmp
memory/3160-2-0x00000280200B0000-0x00000280200CC000-memory.dmp
memory/3160-3-0x00000280200F0000-0x000002802010A000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Azonix.otf
| MD5 | cdfe47b31e9184a55cf02eef1baf7240 |
| SHA1 | b8825c605434d572f5277be0283d5a9b2cde59e4 |
| SHA256 | 51a65e5c09bf27980adf640cb54cb2a5bbb217fdaab79b377e158f92533362a9 |
| SHA512 | a2e5141c0f7ca72bcf5b1a303fce1734953d83ad363d4c3c7d8786e1bfd872a6b96eeabce3740b547a5447e255415cdf688a0d2074cecfaa0c54c49d0f2882c5 |
C:\Windows\Fonts\OpenSansLight.ttf
| MD5 | 1bf71be111189e76987a4bb9b3115cb7 |
| SHA1 | 40442c189568184b6e6c27a25d69f14d91b65039 |
| SHA256 | cf5f5184c1441a1660aa52526328e9d5c2793e77b6d8d3a3ad654bdb07ab8424 |
| SHA512 | cb18b69e98a194af5e3e3d982a75254f3a20bd94c68816a15f38870b9be616cef0c32033f253219cca9146b2b419dd6df28cc4ceeff80d01f400aa0ed101e061 |
memory/3160-21-0x00007FFDD1B50000-0x00007FFDD2612000-memory.dmp
memory/3160-27-0x000002803A1D0000-0x000002803A280000-memory.dmp
memory/3160-34-0x000002803A390000-0x000002803A3B2000-memory.dmp
C:\Users\Admin\AppData\Local\Ambrosial\log.txt
| MD5 | a34ad1bd95cbdf1c0b2580b15bce3300 |
| SHA1 | 084b7e60c2a428c4d761cdce053242401b0fef72 |
| SHA256 | f5ded2055f6890fb6e7d54d1e701d0fa54b2c0259e6877e6ff41bbe3f2402a5f |
| SHA512 | ad1127aab873990f0bc0365f8e24d9bd796eb411caf9a8a679ce8c97e6d8c4375eb9f977a35d383e987f8465b66059364e56b3018bdc9837673f8fb462a2c24d |
C:\Users\Admin\AppData\Local\Ambrosial\log.txt
| MD5 | f04656f76920216a1872613bf05778f6 |
| SHA1 | a58b0d4c20ba43277a790e96dba3e0e35619fa44 |
| SHA256 | 7c141b2c3bfc3403bb4f817ba85bba9067f469e6f12885e733e4cd5593112643 |
| SHA512 | 73864054c015f9682bc95a08b0b707eb02de45bd2ba866256c971bed3fd643d8f4d1543a7674dcfe3341038921473a66320fc8f3848047cad6de96a3ad27441c |
C:\Users\Admin\AppData\Local\Ambrosial\log.txt
| MD5 | 8664a0771bba0f96c3c317f332514b67 |
| SHA1 | 46d20051d15c698b1592bc32f2084a1d05c09e87 |
| SHA256 | 07992cf4e77cdbd86c2f8961a68b68e1a51a106fe749fbc3104284db815724c0 |
| SHA512 | beabf0bd6d5f53171b155c8f78a61ed679df1afc0376085add80978dee767229c89e21881e486e11ec28c83a017cd5abbafd79ac590cbf518cc11c3e8c65290a |
memory/3160-159-0x00007FFDD1B53000-0x00007FFDD1B55000-memory.dmp
memory/3160-177-0x00007FFDD1B50000-0x00007FFDD2612000-memory.dmp
memory/3160-262-0x000002803BEA0000-0x000002803C088000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\0e1a63fc-9228-4b4f-96fc-fee060f96e92\GunaDotNetRT64.dll
| MD5 | 9c43f77cb7cff27cb47ed67babe3eda5 |
| SHA1 | b0400cf68249369d21de86bd26bb84ccffd47c43 |
| SHA256 | f25b9288fe370dcfcb4823fb4e44ab88c7f5fce6e137d0dba389a3dba07d621e |
| SHA512 | cde6fb6cf8db6f9746e69e6c10214e60b3646700d70b49668a2a792e309714dd2d4c5a5241977a833a95fcde8318abcc89eb9968a5039a0b75726bbfa27125a7 |
memory/3160-269-0x00007FFDE8150000-0x00007FFDE8177000-memory.dmp
memory/3160-290-0x000002803BEA0000-0x000002803C084000-memory.dmp
memory/3160-318-0x000002803BEA0000-0x000002803C084000-memory.dmp
memory/3160-306-0x000002803BEA0000-0x000002803C084000-memory.dmp
memory/3160-304-0x000002803BEA0000-0x000002803C084000-memory.dmp
memory/3160-302-0x000002803BEA0000-0x000002803C084000-memory.dmp
memory/3160-300-0x000002803BEA0000-0x000002803C084000-memory.dmp
memory/3160-298-0x000002803BEA0000-0x000002803C084000-memory.dmp
memory/3160-296-0x000002803BEA0000-0x000002803C084000-memory.dmp
memory/3160-294-0x000002803BEA0000-0x000002803C084000-memory.dmp
memory/3160-292-0x000002803BEA0000-0x000002803C084000-memory.dmp
memory/3160-286-0x000002803BEA0000-0x000002803C084000-memory.dmp
memory/3160-284-0x000002803BEA0000-0x000002803C084000-memory.dmp
memory/3160-282-0x000002803BEA0000-0x000002803C084000-memory.dmp
memory/3160-280-0x000002803BEA0000-0x000002803C084000-memory.dmp
memory/3160-278-0x000002803BEA0000-0x000002803C084000-memory.dmp
memory/3160-276-0x000002803BEA0000-0x000002803C084000-memory.dmp
memory/3160-272-0x000002803BEA0000-0x000002803C084000-memory.dmp
memory/3160-271-0x000002803BEA0000-0x000002803C084000-memory.dmp
memory/3160-270-0x00007FFDE3830000-0x00007FFDE397F000-memory.dmp
memory/3160-289-0x000002803BEA0000-0x000002803C084000-memory.dmp
memory/3160-274-0x000002803BEA0000-0x000002803C084000-memory.dmp
memory/3160-334-0x000002803BEA0000-0x000002803C084000-memory.dmp
memory/3160-332-0x000002803BEA0000-0x000002803C084000-memory.dmp
memory/3160-330-0x000002803BEA0000-0x000002803C084000-memory.dmp
memory/3160-328-0x000002803BEA0000-0x000002803C084000-memory.dmp
memory/3160-326-0x000002803BEA0000-0x000002803C084000-memory.dmp
memory/3160-325-0x000002803BEA0000-0x000002803C084000-memory.dmp
memory/3160-322-0x000002803BEA0000-0x000002803C084000-memory.dmp
memory/3160-320-0x000002803BEA0000-0x000002803C084000-memory.dmp
memory/3160-316-0x000002803BEA0000-0x000002803C084000-memory.dmp
memory/3160-314-0x000002803BEA0000-0x000002803C084000-memory.dmp
memory/3160-312-0x000002803BEA0000-0x000002803C084000-memory.dmp
memory/3160-310-0x000002803BEA0000-0x000002803C084000-memory.dmp
memory/3160-308-0x000002803BEA0000-0x000002803C084000-memory.dmp
memory/3160-3603-0x00007FFDE8150000-0x00007FFDE8177000-memory.dmp
memory/3160-11574-0x00007FFDD1B50000-0x00007FFDD2612000-memory.dmp
memory/3160-11575-0x00007FFDD1B50000-0x00007FFDD2612000-memory.dmp
memory/3160-11586-0x00007FFDD1B50000-0x00007FFDD2612000-memory.dmp
C:\Users\Admin\AppData\Local\Ambrosial\assets\clients\1.19.5002.0\Zephyr Classic\launcherAssets\ProjectHalcyon.png
| MD5 | b2cd796f167dc67bd5c4b6f6fca8b6a1 |
| SHA1 | 21d01e26f6b6f41599c338b894c9aa0ff2ca5623 |
| SHA256 | aa3393f4e94fcf46eec9ecf8ab88bfa127aa292bc3b443d13a6207cbbd1f8678 |
| SHA512 | 8eb4b3bf1a92332401a3daf690e269b36265d90af5a18a541c4f8f946454ee5052df408b2c2c3b5c293929f159ebba0bb2f9e24c811998e77b8a7fcf7b7062f3 |
memory/3160-11702-0x00007FFDD1B50000-0x00007FFDD2612000-memory.dmp
memory/3160-11703-0x00007FFDD1B50000-0x00007FFDD2612000-memory.dmp
memory/3160-11704-0x00007FFDD1B50000-0x00007FFDD2612000-memory.dmp
memory/3160-11705-0x00007FFDD1B50000-0x00007FFDD2612000-memory.dmp
memory/3160-11706-0x00007FFDD1B50000-0x00007FFDD2612000-memory.dmp
memory/3160-11707-0x00007FFDD1B50000-0x00007FFDD2612000-memory.dmp