Analysis
-
max time kernel
113s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
22/03/2025, 06:09
General
-
Target
2b820e3de58782883087f0783d484f95.exe
-
Size
6.5MB
-
MD5
2b820e3de58782883087f0783d484f95
-
SHA1
b5a4c93813e01b10f948cd46e83ae16c64299284
-
SHA256
b5eaf05525428e4f6db4343e9070a7afefb91694926e3c75b7b0ec0d16cf57c8
-
SHA512
f48ad7fae5b3c453dd6e7a291836376865e690b20bca38e6465832dd6c5d7aa568f655939e4f3f530eec4285bf01b23e7acec72c52a691fd31d92e3b05bce984
-
SSDEEP
98304:0VgvtU3ioYGQlAkxpP2vrXGwy6T4ng5WbkTYFnZ2+mPjcElY5ZubP+uvq:0T2GIAkxpuvrXGwygzEFQ+pEl0Zuj
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Obfuscated with Agile.Net obfuscator 4 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b820e3de58782883087f0783d484f95.exe"C:\Users\Admin\AppData\Local\Temp\2b820e3de58782883087f0783d484f95.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f4 0x4041⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
632KB
MD5ddc305fca2a8d80523ad8bc50996480b
SHA17bee723b565267aa355ad9f7f5cf17c74f2cce1f
SHA256af9e46b70c7739547739ddfcdd56b7b218b5bda6e14c49bed3bbc08c2b867216
SHA512acf2064d1b59d73cc5086f9a8c26a5e1fb7e7909e5460d3427d7681ee36709a568146000bbea9464fb173df474c58bda4f87bbbb759ea06ed2fd71d3c6bc0eea
-
Filesize
218KB
MD582dbc53c4e057ad941eb73aba212956e
SHA138a582ce5fbe03e8c5f040d82f89b4797e305860
SHA256eda3f66eedc49ff9b9506c1ccf679a7822104c771eaab3afa367f0d6a2c9bbd5
SHA5126f8e9082750c9cc8eb7bcaf7b7442f52ec55e2b712fff29a3a22868218fbfd605b594314e7be2720fd25f5a89d95774481177429de35acb48d023d39a2767781
-
Filesize
832KB
MD56aab5c90d7c703ed4aefd5100c97fd22
SHA1b6bb0a5614da9565d5ef2a5a23aa0aaa5bd5b3f0
SHA2561b796196d9ae7b15507546d53a2b5aeae36e5b80e6291f02317f6fedab18d74a
SHA5126c1c1cc6da08f49d15f6cbbadc81bdfaa4251d9ecc9321e0de474141534b42f2bc4c4ada053ace81e07635478f945d2266466f45f9e55c3c924c974d86c26251
-
Filesize
352KB
-
Filesize
24KB
-
Filesize
10.8MB
-
Filesize
648KB
-
Filesize
8KB
-
Filesize
136KB
-
Filesize
744KB
-
Filesize
272KB
-
Filesize
200KB
-
Filesize
10.8MB
-
Filesize
32KB
-
Filesize
2.6MB
-
Filesize
10.8MB
-
Filesize
1.5MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
6.5MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB