2bd9aaefd640dd2ff0afcc994ebf0b66f7b5ebb05fd38d78ef04815e901b4994

Resubmissions

26-06-2024 16:28

240626-ty494svgrk 7

Analysis

max time kernel
13s
max time network
14s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
26-06-2024 16:28

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

AimBolt.exe
Size

761KB
MD5

f4207c97ef68f04fdfb837133fe06fe4
SHA1

910f4cdf8987936ce76b4314b53e634fb517a182
SHA256

2bd9aaefd640dd2ff0afcc994ebf0b66f7b5ebb05fd38d78ef04815e901b4994
SHA512

e0fe67bf6434397ceb89ea10746165526c852ec6ea5d6c92e74d1c34e0ca94a9e1d6ba30dcf36a29ed6b4ff835fac5e1b314469e4078a12e4e319e4661a491e4
SSDEEP

12288:a3aVvTuaH8x4D9NDj9JIEMrBaolQIYgsPyQGl50qrx80nFJlLA13AKVe1gWwjU:aKVvTNHTLj99qT4gsF8msJlc1QKVdjU

Score

7^/10

agilenet

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2412 cmd.exe
Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
agilenet

Processes:

resource yara_rule

behavioral1/memory/3028-6-0x000000001B410000-0x000000001B560000-memory.dmp agile_net
C:\Users\Admin\AppData\Local\Temp\4E36753A.dll agile_net
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

AimBolt.exe

pid process

3028 AimBolt.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2544 PING.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AimBolt.exe

pid process

3028 AimBolt.exe
3028 AimBolt.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

AimBolt.exeshutdown.exe

description pid process

Token: SeDebugPrivilege 3028 AimBolt.exe
Token: SeShutdownPrivilege 2568 shutdown.exe
Token: SeRemoteShutdownPrivilege 2568 shutdown.exe

pid	process
2412	cmd.exe

resource	yara_rule
behavioral1/memory/3028-6-0x000000001B410000-0x000000001B560000-memory.dmp	agile_net
C:\Users\Admin\AppData\Local\Temp\4E36753A.dll	agile_net

pid	process
3028	AimBolt.exe

pid	process
2544	PING.EXE

pid	process
3028	AimBolt.exe
3028	AimBolt.exe

description	pid	process
Token: SeDebugPrivilege	3028	AimBolt.exe
Token: SeShutdownPrivilege	2568	shutdown.exe
Token: SeRemoteShutdownPrivilege	2568	shutdown.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

AimBolt.execmd.exe

description	pid	process	target process
PID 3028 wrote to memory of 2568	3028	AimBolt.exe	shutdown.exe
PID 3028 wrote to memory of 2568	3028	AimBolt.exe	shutdown.exe
PID 3028 wrote to memory of 2568	3028	AimBolt.exe	shutdown.exe
PID 3028 wrote to memory of 2412	3028	AimBolt.exe	cmd.exe
PID 3028 wrote to memory of 2412	3028	AimBolt.exe	cmd.exe
PID 3028 wrote to memory of 2412	3028	AimBolt.exe	cmd.exe
PID 2412 wrote to memory of 2544	2412	cmd.exe	PING.EXE
PID 2412 wrote to memory of 2544	2412	cmd.exe	PING.EXE
PID 2412 wrote to memory of 2544	2412	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\AimBolt.exe
"C:\Users\Admin\AppData\Local\Temp\AimBolt.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3028

C:\Windows\System32\shutdown.exe
"C:\Windows\System32\shutdown.exe" /s /t 10
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2568

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\AimBolt.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2412

C:\Windows\system32\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
3⤵
- Runs ping.exe
PID:2544

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2440

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1580

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4E36753A.dll
Filesize
604KB

MD5
ae13a6e81de14733bed53890e94fed12

SHA1
f389fdbcaf43fbbd66c978583d77b16fe3706532

SHA256
3d61760635822a4245ef3910db392685da64101fdd2f0f51ca0ccb18d92aa0e1

SHA512
6ab8abe209b28119ce0db495f7157969248ea1116ab939d53489f147411ba8546b5599417fa6a4e29d391815e1dc77f24b84e70cc3513e047cf370da65609b25

Download Submit
memory/3028-0-0x000007FEF5693000-0x000007FEF5694000-memory.dmp

Filesize
4KB

Download
memory/3028-1-0x00000000008E0000-0x00000000009A6000-memory.dmp

Filesize
792KB

Download
memory/3028-4-0x000007FEF5690000-0x000007FEF607C000-memory.dmp

Filesize
9.9MB

Download
memory/3028-6-0x000000001B410000-0x000000001B560000-memory.dmp

Filesize
1.3MB

Download
memory/3028-8-0x000007FEF5690000-0x000007FEF607C000-memory.dmp

Filesize
9.9MB

Download
memory/3028-9-0x0000000000160000-0x0000000000166000-memory.dmp

Filesize
24KB

Download
memory/3028-11-0x000007FEF5690000-0x000007FEF607C000-memory.dmp

Filesize
9.9MB

Download
memory/3028-12-0x000007FEF5690000-0x000007FEF607C000-memory.dmp

Filesize
9.9MB

Download
memory/3028-13-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/3028-14-0x00000000003B0000-0x00000000003CA000-memory.dmp

Filesize
104KB

Download
memory/3028-15-0x000007FEF5690000-0x000007FEF607C000-memory.dmp

Filesize
9.9MB

Download