Overview

overview

7

Static

static

7

e8d13ea01a...1c.exe

windows7-x64

7

e8d13ea01a...1c.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    139s
  • max time network
    103s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-06-2024 17:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e8d13ea01a0c177cce13e6a66bf3eb89fa7c2f344915bdeb19ebeb4a2a25bd1c.exe

  • Size

    3.2MB

  • MD5

    9b42fe973f447660b0657e03d3a4652d

  • SHA1

    ccaffc44e37c4f80847b704f91fc5e8f73c79e93

  • SHA256

    e8d13ea01a0c177cce13e6a66bf3eb89fa7c2f344915bdeb19ebeb4a2a25bd1c

  • SHA512

    788ddac594d684bff8ff82d425471125ef463867df4312f7ae71b6c689301bd6bcda0a8ee80df7d610c82d545ea39fb91b5f672c4c4753a01f32346af0661e87

  • SSDEEP

    49152:lnoTcakniojevgr1QQ6ToFVKQQ3COvBC/kJN+lRdQtsqQtsjrXw:dkojeiZbdqdjr

Score
7/10
agilenet

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Obfuscated with Agile.Net obfuscator 2 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e8d13ea01a0c177cce13e6a66bf3eb89fa7c2f344915bdeb19ebeb4a2a25bd1c.exe
    "C:\Users\Admin\AppData\Local\Temp\e8d13ea01a0c177cce13e6a66bf3eb89fa7c2f344915bdeb19ebeb4a2a25bd1c.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\921d21f0-2afc-42ec-b095-9a238b804f5e\AgileDotNetRT.dll
    Filesize

    136KB

    MD5

    54ab56509d910c969b9c287fde10026d

    SHA1

    b0929cd61e4428d57191b0c41ad60765236bed4c

    SHA256

    998b95107a40360c441b4d1211f9f2e5ea9d004017baa383ffbe1a46cf08bfd0

    SHA512

    b16722ac2662362d6ee37620f1ab2dcee05e0a54b49dbc8bb2d93561f35f2f09e4dd8f0bc6139d57a5424a7b76c62dafef62a7f355ea1963e7fcdce180cdd2e8

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\KeySetting.ini
    Filesize

    5KB

    MD5

    a577faedb5c93633ba3e67224450f067

    SHA1

    097252aa38c841bb6d0e779010a5504b3d448861

    SHA256

    5b2ce1c6056102d392516693ea86cda5932ca7099f56701162f00ebebcf004ae

    SHA512

    b2d9ea444ebe85c5530439bb1789609c33b5b6726b2255fcbd3e8f1465d522338cf356f7513669c46c94fdf4235fbc09df8836a006b8aafdfb0df7ee8a88ca93

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\KeySetting.ini
    Filesize

    8KB

    MD5

    37f3f5bba46b064a04c4a64fe5dbcde9

    SHA1

    7c854a1959772eb151097458a9cfc38e7232c51c

    SHA256

    133dc1fab0eebb57d4c3cc2669da8df4604813d1d44033def119540a3e460af1

    SHA512

    968a47df6b410d46d01247ad9d7526408b4cebe70424c38b53be33dd3a2a1b781a74aab3958b752037c74b20b4521cce5aa018071e726878ae6e203a06c95335

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\Language.ini
    Filesize

    7KB

    MD5

    a17174b14f0bbf21df754c9ffbfbf535

    SHA1

    176c0ec54864e3126467b84711df1ed096214d7a

    SHA256

    02d7c1a31c4b30071ab929b839539a024f54df1f8e0af2b13513030149250930

    SHA512

    15a527c6be22fcbba9df63854ead7cb35cabdc1715149984c8be1d7e9ffe93db88e29b0ca6904df23f82052ee014a42114361ffc62e0d55009ded76c99c49377

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\Mir2Test.ini
    Filesize

    1KB

    MD5

    18a61e6300685a441aa20ebe25bffc39

    SHA1

    d5733c4c780b6003801943c55bbe95edad9b0d37

    SHA256

    ad6d2359ce33c6910970572cd53f3d7569723336cd80626a0701da69acbe79b7

    SHA512

    0e1023ddf501cba2656a784182643934d791c96152e084f61f32a5336ebb12f789e6153eb5611ec6baa23b999169cc0b1feb46e7033446359db160af1e6e3184

    Download Submit
  • memory/376-470-0x00000000052D0000-0x000000000560E000-memory.dmp
    Filesize

    3.2MB

    Download
  • memory/376-1-0x0000000000240000-0x000000000057E000-memory.dmp
    Filesize

    3.2MB

    Download
  • memory/376-13-0x0000000005130000-0x00000000051C2000-memory.dmp
    Filesize

    584KB

    Download
  • memory/376-11-0x0000000072640000-0x0000000072677000-memory.dmp
    Filesize

    220KB

    Download
  • memory/376-9-0x0000000073110000-0x0000000073199000-memory.dmp
    Filesize

    548KB

    Download
  • memory/376-0-0x000000007470E000-0x000000007470F000-memory.dmp
    Filesize

    4KB

    Download
  • memory/376-10-0x0000000074700000-0x0000000074EB0000-memory.dmp
    Filesize

    7.7MB

    Download
  • memory/376-12-0x0000000005640000-0x0000000005BE4000-memory.dmp
    Filesize

    5.6MB

    Download
  • memory/376-735-0x0000000006080000-0x000000000608A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/376-736-0x0000000074700000-0x0000000074EB0000-memory.dmp
    Filesize

    7.7MB

    Download
  • memory/376-737-0x0000000074700000-0x0000000074EB0000-memory.dmp
    Filesize

    7.7MB

    Download
  • memory/376-738-0x0000000074700000-0x0000000074EB0000-memory.dmp
    Filesize

    7.7MB

    Download
  • memory/376-739-0x000000007470E000-0x000000007470F000-memory.dmp
    Filesize

    4KB

    Download
  • memory/376-740-0x0000000074700000-0x0000000074EB0000-memory.dmp
    Filesize

    7.7MB

    Download
  • memory/376-741-0x0000000072640000-0x0000000072677000-memory.dmp
    Filesize

    220KB

    Download