e8d13ea01a0c177cce13e6a66bf3eb89fa7c2f344915bdeb19ebeb4a2a25bd1c

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 17:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8d13ea01a0c177cce13e6a66bf3eb89fa7c2f344915bdeb19ebeb4a2a25bd1c.exe
Size

3.2MB
MD5

9b42fe973f447660b0657e03d3a4652d
SHA1

ccaffc44e37c4f80847b704f91fc5e8f73c79e93
SHA256

e8d13ea01a0c177cce13e6a66bf3eb89fa7c2f344915bdeb19ebeb4a2a25bd1c
SHA512

788ddac594d684bff8ff82d425471125ef463867df4312f7ae71b6c689301bd6bcda0a8ee80df7d610c82d545ea39fb91b5f672c4c4753a01f32346af0661e87
SSDEEP

49152:lnoTcakniojevgr1QQ6ToFVKQQ3COvBC/kJN+lRdQtsqQtsjrXw:dkojeiZbdqdjr

Score

7^/10

agilenet

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

e8d13ea01a0c177cce13e6a66bf3eb89fa7c2f344915bdeb19ebeb4a2a25bd1c.exe

pid process

2512 e8d13ea01a0c177cce13e6a66bf3eb89fa7c2f344915bdeb19ebeb4a2a25bd1c.exe
Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
agilenet

Processes:

resource yara_rule

behavioral1/memory/2512-1-0x00000000011E0000-0x000000000151E000-memory.dmp agile_net
behavioral1/memory/2512-467-0x0000000005960000-0x0000000005C9E000-memory.dmp agile_net

resource	yara_rule
behavioral1/memory/2512-1-0x00000000011E0000-0x000000000151E000-memory.dmp	agile_net
behavioral1/memory/2512-467-0x0000000005960000-0x0000000005C9E000-memory.dmp	agile_net

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

e8d13ea01a0c177cce13e6a66bf3eb89fa7c2f344915bdeb19ebeb4a2a25bd1c.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	e8d13ea01a0c177cce13e6a66bf3eb89fa7c2f344915bdeb19ebeb4a2a25bd1c.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

e8d13ea01a0c177cce13e6a66bf3eb89fa7c2f344915bdeb19ebeb4a2a25bd1c.exe

pid	process
2512	e8d13ea01a0c177cce13e6a66bf3eb89fa7c2f344915bdeb19ebeb4a2a25bd1c.exe
2512	e8d13ea01a0c177cce13e6a66bf3eb89fa7c2f344915bdeb19ebeb4a2a25bd1c.exe
2512	e8d13ea01a0c177cce13e6a66bf3eb89fa7c2f344915bdeb19ebeb4a2a25bd1c.exe
2512	e8d13ea01a0c177cce13e6a66bf3eb89fa7c2f344915bdeb19ebeb4a2a25bd1c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e8d13ea01a0c177cce13e6a66bf3eb89fa7c2f344915bdeb19ebeb4a2a25bd1c.exe

description pid process

Token: SeDebugPrivilege 2512 e8d13ea01a0c177cce13e6a66bf3eb89fa7c2f344915bdeb19ebeb4a2a25bd1c.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

e8d13ea01a0c177cce13e6a66bf3eb89fa7c2f344915bdeb19ebeb4a2a25bd1c.exe

pid process

2512 e8d13ea01a0c177cce13e6a66bf3eb89fa7c2f344915bdeb19ebeb4a2a25bd1c.exe
2512 e8d13ea01a0c177cce13e6a66bf3eb89fa7c2f344915bdeb19ebeb4a2a25bd1c.exe

description	pid	process
Token: SeDebugPrivilege	2512	e8d13ea01a0c177cce13e6a66bf3eb89fa7c2f344915bdeb19ebeb4a2a25bd1c.exe

C:\Users\Admin\AppData\Local\Temp\e8d13ea01a0c177cce13e6a66bf3eb89fa7c2f344915bdeb19ebeb4a2a25bd1c.exe
"C:\Users\Admin\AppData\Local\Temp\e8d13ea01a0c177cce13e6a66bf3eb89fa7c2f344915bdeb19ebeb4a2a25bd1c.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2512

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\KeySetting.ini
Filesize
8KB

MD5
37f3f5bba46b064a04c4a64fe5dbcde9

SHA1
7c854a1959772eb151097458a9cfc38e7232c51c

SHA256
133dc1fab0eebb57d4c3cc2669da8df4604813d1d44033def119540a3e460af1

SHA512
968a47df6b410d46d01247ad9d7526408b4cebe70424c38b53be33dd3a2a1b781a74aab3958b752037c74b20b4521cce5aa018071e726878ae6e203a06c95335

Download Submit
C:\Users\Admin\AppData\Local\Temp\Language.ini
Filesize
7KB

MD5
a17174b14f0bbf21df754c9ffbfbf535

SHA1
176c0ec54864e3126467b84711df1ed096214d7a

SHA256
02d7c1a31c4b30071ab929b839539a024f54df1f8e0af2b13513030149250930

SHA512
15a527c6be22fcbba9df63854ead7cb35cabdc1715149984c8be1d7e9ffe93db88e29b0ca6904df23f82052ee014a42114361ffc62e0d55009ded76c99c49377

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mir2Test.ini
Filesize
1KB

MD5
18a61e6300685a441aa20ebe25bffc39

SHA1
d5733c4c780b6003801943c55bbe95edad9b0d37

SHA256
ad6d2359ce33c6910970572cd53f3d7569723336cd80626a0701da69acbe79b7

SHA512
0e1023ddf501cba2656a784182643934d791c96152e084f61f32a5336ebb12f789e6153eb5611ec6baa23b999169cc0b1feb46e7033446359db160af1e6e3184

Download Submit
\Users\Admin\AppData\Local\Temp\921d21f0-2afc-42ec-b095-9a238b804f5e\AgileDotNetRT.dll
Filesize
136KB

MD5
54ab56509d910c969b9c287fde10026d

SHA1
b0929cd61e4428d57191b0c41ad60765236bed4c

SHA256
998b95107a40360c441b4d1211f9f2e5ea9d004017baa383ffbe1a46cf08bfd0

SHA512
b16722ac2662362d6ee37620f1ab2dcee05e0a54b49dbc8bb2d93561f35f2f09e4dd8f0bc6139d57a5424a7b76c62dafef62a7f355ea1963e7fcdce180cdd2e8

Download Submit
memory/2512-9-0x0000000074B40000-0x000000007522E000-memory.dmp

Filesize
6.9MB

Download
memory/2512-8-0x0000000074940000-0x00000000749C0000-memory.dmp

Filesize
512KB

Download
memory/2512-467-0x0000000005960000-0x0000000005C9E000-memory.dmp

Filesize
3.2MB

Download
memory/2512-0-0x0000000074B4E000-0x0000000074B4F000-memory.dmp

Filesize
4KB

Download
memory/2512-10-0x0000000074900000-0x0000000074937000-memory.dmp

Filesize
220KB

Download
memory/2512-1-0x00000000011E0000-0x000000000151E000-memory.dmp

Filesize
3.2MB

Download
memory/2512-732-0x0000000074B40000-0x000000007522E000-memory.dmp

Filesize
6.9MB

Download
memory/2512-733-0x0000000074B40000-0x000000007522E000-memory.dmp

Filesize
6.9MB

Download
memory/2512-734-0x0000000074B40000-0x000000007522E000-memory.dmp

Filesize
6.9MB

Download
memory/2512-740-0x000000000C810000-0x000000000CFB6000-memory.dmp

Filesize
7.6MB

Download
memory/2512-741-0x0000000074B4E000-0x0000000074B4F000-memory.dmp

Filesize
4KB

Download
memory/2512-742-0x0000000074B40000-0x000000007522E000-memory.dmp

Filesize
6.9MB

Download
memory/2512-743-0x0000000074900000-0x0000000074937000-memory.dmp

Filesize
220KB

Download