2bd9aaefd640dd2ff0afcc994ebf0b66f7b5ebb05fd38d78ef04815e901b4994

Analysis

max time kernel
140s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
26-06-2024 16:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AimBolt.exe
Size

761KB
MD5

f4207c97ef68f04fdfb837133fe06fe4
SHA1

910f4cdf8987936ce76b4314b53e634fb517a182
SHA256

2bd9aaefd640dd2ff0afcc994ebf0b66f7b5ebb05fd38d78ef04815e901b4994
SHA512

e0fe67bf6434397ceb89ea10746165526c852ec6ea5d6c92e74d1c34e0ca94a9e1d6ba30dcf36a29ed6b4ff835fac5e1b314469e4078a12e4e319e4661a491e4
SSDEEP

12288:a3aVvTuaH8x4D9NDj9JIEMrBaolQIYgsPyQGl50qrx80nFJlLA13AKVe1gWwjU:aKVvTNHTLj99qT4gsF8msJlc1QKVdjU

Score

7^/10

agilenet

Malware Config

Signatures

Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
agilenet

Processes:

resource yara_rule

behavioral2/memory/2200-6-0x00000196EDD30000-0x00000196EDE80000-memory.dmp agile_net
C:\Users\Admin\AppData\Local\Temp\4E36753A.dll agile_net

resource	yara_rule
behavioral2/memory/2200-6-0x00000196EDD30000-0x00000196EDE80000-memory.dmp	agile_net
C:\Users\Admin\AppData\Local\Temp\4E36753A.dll	agile_net

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

Processes:

AimBolt.exe

pid	process
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

AimBolt.exe

pid	process
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe
2200	AimBolt.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AimBolt.exe

description pid process

Token: SeDebugPrivilege 2200 AimBolt.exe

description	pid	process
Token: SeDebugPrivilege	2200	AimBolt.exe

C:\Users\Admin\AppData\Local\Temp\AimBolt.exe
"C:\Users\Admin\AppData\Local\Temp\AimBolt.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4E36753A.dll
Filesize
604KB

MD5
ae13a6e81de14733bed53890e94fed12

SHA1
f389fdbcaf43fbbd66c978583d77b16fe3706532

SHA256
3d61760635822a4245ef3910db392685da64101fdd2f0f51ca0ccb18d92aa0e1

SHA512
6ab8abe209b28119ce0db495f7157969248ea1116ab939d53489f147411ba8546b5599417fa6a4e29d391815e1dc77f24b84e70cc3513e047cf370da65609b25

Download Submit
memory/2200-14-0x00000196EDAE0000-0x00000196EDAFA000-memory.dmp

Filesize
104KB

Download
memory/2200-22-0x00007FFB1C900000-0x00007FFB1D3C1000-memory.dmp

Filesize
10.8MB

Download
memory/2200-6-0x00000196EDD30000-0x00000196EDE80000-memory.dmp

Filesize
1.3MB

Download
memory/2200-8-0x00000196EB960000-0x00000196EB966000-memory.dmp

Filesize
24KB

Download
memory/2200-9-0x00007FFB1C900000-0x00007FFB1D3C1000-memory.dmp

Filesize
10.8MB

Download
memory/2200-1-0x00007FFB1C903000-0x00007FFB1C905000-memory.dmp

Filesize
8KB

Download
memory/2200-11-0x00007FFB1C900000-0x00007FFB1D3C1000-memory.dmp

Filesize
10.8MB

Download
memory/2200-15-0x00000196EDB70000-0x00000196EDB82000-memory.dmp

Filesize
72KB

Download
memory/2200-25-0x00007FFB1C900000-0x00007FFB1D3C1000-memory.dmp

Filesize
10.8MB

Download
memory/2200-4-0x00007FFB1C900000-0x00007FFB1D3C1000-memory.dmp

Filesize
10.8MB

Download
memory/2200-12-0x00007FFB1C900000-0x00007FFB1D3C1000-memory.dmp

Filesize
10.8MB

Download
memory/2200-16-0x00000196EE1C0000-0x00000196EE1FC000-memory.dmp

Filesize
240KB

Download
memory/2200-17-0x00007FFB1C900000-0x00007FFB1D3C1000-memory.dmp

Filesize
10.8MB

Download
memory/2200-18-0x00007FFB1C900000-0x00007FFB1D3C1000-memory.dmp

Filesize
10.8MB

Download
memory/2200-19-0x00007FFB1C903000-0x00007FFB1C905000-memory.dmp

Filesize
8KB

Download
memory/2200-20-0x00007FFB1C900000-0x00007FFB1D3C1000-memory.dmp

Filesize
10.8MB

Download
memory/2200-21-0x00007FFB1C900000-0x00007FFB1D3C1000-memory.dmp

Filesize
10.8MB

Download
memory/2200-0-0x00000196EB4E0000-0x00000196EB5A6000-memory.dmp

Filesize
792KB

Download
memory/2200-23-0x00007FFB1C900000-0x00007FFB1D3C1000-memory.dmp

Filesize
10.8MB

Download
memory/2200-13-0x00000196EB970000-0x00000196EB976000-memory.dmp

Filesize
24KB

Download