Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/01/2025, 01:01

General

  • Target

    1efaca81cc2f95850a1d8b1728c866f37f1ce5bc74ff439a1dae9ce5b4e950fb.exe

  • Size

    22.3MB

  • MD5

    ddd9abe3b6c165dca62da949ee2f4084

  • SHA1

    5fc389f190857fb7f4a55f04037c94404dabf7d5

  • SHA256

    1efaca81cc2f95850a1d8b1728c866f37f1ce5bc74ff439a1dae9ce5b4e950fb

  • SHA512

    b838f73cc7fe968346893d93cc8b29a583d5be9f63b4a57fee063390395de5171901ebbdf9ac76afcf0aff2dd3e6555d02a9c9ad66e914704a9be384fa9a9084

  • SSDEEP

    393216:qYM4xYPYE4/5jpC1FhK+sQ4oy6OntgiOGIUrc7Cwrc2G/Ui6pBt/a9:9E4F4s3SOOiOdUrcprzG/Ul+

Score
7/10

Malware Config

Signatures

  • Obfuscated with Agile.Net obfuscator 2 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1efaca81cc2f95850a1d8b1728c866f37f1ce5bc74ff439a1dae9ce5b4e950fb.exe
    "C:\Users\Admin\AppData\Local\Temp\1efaca81cc2f95850a1d8b1728c866f37f1ce5bc74ff439a1dae9ce5b4e950fb.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:4656
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 1792
      2⤵
      • Program crash
      PID:316
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4656 -ip 4656
    1⤵
      PID:4820

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/4656-0-0x000000007527E000-0x000000007527F000-memory.dmp

            Filesize

            4KB

          • memory/4656-1-0x0000000000840000-0x0000000001E98000-memory.dmp

            Filesize

            22.3MB

          • memory/4656-2-0x0000000006EC0000-0x0000000007464000-memory.dmp

            Filesize

            5.6MB

          • memory/4656-3-0x0000000006910000-0x00000000069A2000-memory.dmp

            Filesize

            584KB

          • memory/4656-4-0x0000000004320000-0x000000000432A000-memory.dmp

            Filesize

            40KB

          • memory/4656-5-0x0000000075270000-0x0000000075A20000-memory.dmp

            Filesize

            7.7MB

          • memory/4656-7-0x0000000006E70000-0x0000000006E82000-memory.dmp

            Filesize

            72KB

          • memory/4656-30-0x0000000007910000-0x000000000791A000-memory.dmp

            Filesize

            40KB

          • memory/4656-31-0x0000000007990000-0x00000000079CC000-memory.dmp

            Filesize

            240KB

          • memory/4656-32-0x00000000079E0000-0x0000000007A4A000-memory.dmp

            Filesize

            424KB

          • memory/4656-33-0x0000000007A50000-0x0000000007A6E000-memory.dmp

            Filesize

            120KB

          • memory/4656-34-0x0000000008880000-0x00000000089CA000-memory.dmp

            Filesize

            1.3MB

          • memory/4656-35-0x00000000089D0000-0x0000000008A00000-memory.dmp

            Filesize

            192KB

          • memory/4656-36-0x0000000009FC0000-0x000000000A0D6000-memory.dmp

            Filesize

            1.1MB

          • memory/4656-37-0x0000000075270000-0x0000000075A20000-memory.dmp

            Filesize

            7.7MB