Analysis
- max time kernel
93s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
14/01/2025, 01:02
General
- Target fc3b80514864bc18ab5f1a2c243889c5775e2df31edc7db42a5ab2a3f96e9d96.exe
- Size 22.3MB
- Sample250114-bdwhcssldy
- SHA256 fc3b80514864bc18ab5f1a2c243889c5775e2df31edc7db42a5ab2a3f96e9d96
Malware Config
Signatures
- Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc3b80514864bc18ab5f1a2c243889c5775e2df31edc7db42a5ab2a3f96e9d96.exe"C:\Users\Admin\AppData\Local\Temp\fc3b80514864bc18ab5f1a2c243889c5775e2df31edc7db42a5ab2a3f96e9d96.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 17962⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4608 -ip 46081⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4608-0-0x000000007520E000-0x000000007520F000-memory.dmp
memory/4608-1-0x0000000000D20000-0x0000000002378000-memory.dmp
memory/4608-2-0x00000000074C0000-0x0000000007A64000-memory.dmp
memory/4608-3-0x0000000006DB0000-0x0000000006E42000-memory.dmp
memory/4608-4-0x0000000006CF0000-0x0000000006CFA000-memory.dmp
memory/4608-5-0x0000000075200000-0x00000000759B0000-memory.dmp
memory/4608-7-0x0000000006ED0000-0x0000000006EE2000-memory.dmp
memory/4608-30-0x0000000007DE0000-0x0000000007DEA000-memory.dmp
memory/4608-31-0x0000000007E60000-0x0000000007E9C000-memory.dmp
memory/4608-32-0x0000000007EE0000-0x0000000007F4A000-memory.dmp
memory/4608-33-0x0000000007EB0000-0x0000000007ECE000-memory.dmp
memory/4608-34-0x0000000008D60000-0x0000000008EAA000-memory.dmp
memory/4608-35-0x0000000008EB0000-0x0000000008EE0000-memory.dmp
memory/4608-36-0x000000000A4A0000-0x000000000A5B6000-memory.dmp
memory/4608-37-0x0000000075200000-0x00000000759B0000-memory.dmp