Analysis
- max time kernel
1s - max time network
64s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-es - resource tags
- submitted
08/08/2026, 00:25
General
- Target Ambrosial.exe
- Size 15.9MB
- Sample260808-aql9sawele
- SHA256 b9c94c4a6dca1b5a42b05e4814838a9281768ba9267803a554c23b68c0665b0f
Malware Config
Signatures
- Obfuscated with Agile.Net obfuscator 64 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in Windows directory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe"C:\Users\Admin\AppData\Local\Temp\Ambrosial.exe"1⤵
- Drops file in Windows directory
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
log.txt
log.txt
GunaDotNetRT64.dll
memory/6128-141-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-143-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-6-0x000001BACB330000-0x000001BACB34A000-memory.dmp
memory/6128-4-0x00007FF88A6E0000-0x00007FF88B084000-memory.dmp
memory/6128-10-0x000001BAE5A50000-0x000001BAE5B52000-memory.dmp
memory/6128-16-0x00007FF88A6E0000-0x00007FF88B084000-memory.dmp
memory/6128-17-0x000001BAE5940000-0x000001BAE59F0000-memory.dmp
memory/6128-20-0x00007FF88A6E0000-0x00007FF88B084000-memory.dmp
memory/6128-21-0x00007FF88A6E0000-0x00007FF88B084000-memory.dmp
memory/6128-22-0x00007FF88A6E0000-0x00007FF88B084000-memory.dmp
memory/6128-27-0x000001BAE59F0000-0x000001BAE5A12000-memory.dmp
memory/6128-33-0x00007FF88A6E0000-0x00007FF88B084000-memory.dmp
memory/6128-28-0x00007FF88A6E0000-0x00007FF88B084000-memory.dmp
memory/6128-34-0x00007FF88A6E0000-0x00007FF88B084000-memory.dmp
memory/6128-35-0x00007FF88A6E0000-0x00007FF88B084000-memory.dmp
memory/6128-38-0x00007FF88A6E0000-0x00007FF88B084000-memory.dmp
memory/6128-36-0x000001BAE5EE0000-0x000001BAE5F20000-memory.dmp
memory/6128-135-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-2-0x00007FF88A6E0000-0x00007FF88B084000-memory.dmp
memory/6128-55-0x000001BAE6A10000-0x000001BAE6BF8000-memory.dmp
memory/6128-1-0x000001BAC9E90000-0x000001BACAE76000-memory.dmp
memory/6128-62-0x00007FF8A18D0000-0x00007FF8A18F7000-memory.dmp
memory/6128-71-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-69-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-67-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-65-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-64-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-63-0x00007FF8957B0000-0x00007FF8958DF000-memory.dmp
memory/6128-131-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-80-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-81-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-74-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-77-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-75-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-156-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-151-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-160-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-149-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-148-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-145-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-137-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-0-0x00007FF88A86F000-0x00007FF88A870000-memory.dmp
memory/6128-5-0x000001BACB2E0000-0x000001BACB2FC000-memory.dmp
memory/6128-139-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-3-0x00007FF88A6E0000-0x00007FF88B084000-memory.dmp
memory/6128-133-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-129-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-127-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-125-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-123-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-121-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-118-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-119-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-115-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-113-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-111-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-109-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-107-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-105-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-103-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-101-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-99-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-97-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-95-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-93-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-91-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-89-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-87-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-85-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-83-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-163-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-187-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-185-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-184-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-181-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-179-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-177-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-175-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-174-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-172-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-170-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-167-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-165-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-161-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-153-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-157-0x000001BAE6A10000-0x000001BAE6BF4000-memory.dmp
memory/6128-4626-0x00007FF88A6E0000-0x00007FF88B084000-memory.dmp