Analysis Overview
SHA256
6964610d95c57d566f04cb19825596b2351f11f348c05c81fdbed85eb16e04f8
Threat Level: Known bad
The file 10174362958.zip was found to be: Known bad.
Malicious Activity Summary
Agenda family
Agenda Ransomware
MITRE ATT&CK Matrix
Analysis: static1
Detonation Overview
Reported
2023-04-19 11:02
Signatures
Agenda family
Analysis: behavioral1
Detonation Overview
Submitted
2023-04-19 11:02
Reported
2023-04-19 11:05
Platform
win7-20230220-en
Max time kernel
29s
Max time network
35s
Command Line
Signatures
Agenda Ransomware
Processes
C:\Users\Admin\AppData\Local\Temp\e90bdaaf5f9ca900133b699f18e4062562148169b29cb4eb37a0577388c22527.exe
"C:\Users\Admin\AppData\Local\Temp\e90bdaaf5f9ca900133b699f18e4062562148169b29cb4eb37a0577388c22527.exe"
Network
Files
memory/1288-54-0x0000000000F60000-0x00000000010F8000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2023-04-19 11:02
Reported
2023-04-19 11:05
Platform
win10v2004-20230220-en
Max time kernel
150s
Max time network
152s
Command Line
Signatures
Agenda Ransomware
Processes
C:\Users\Admin\AppData\Local\Temp\e90bdaaf5f9ca900133b699f18e4062562148169b29cb4eb37a0577388c22527.exe
"C:\Users\Admin\AppData\Local\Temp\e90bdaaf5f9ca900133b699f18e4062562148169b29cb4eb37a0577388c22527.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.3.197.209.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 93.184.220.29:80 | tcp | |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 164.113.223.173.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 74.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 42.220.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 40.77.2.164:443 | tcp | |
| US | 40.77.2.164:443 | tcp | |
| US | 40.77.2.164:443 | tcp | |
| DE | 162.19.139.184:2222 | tcp | |
| NL | 87.248.202.1:80 | tcp | |
| NL | 87.248.202.1:80 | tcp | |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 64.13.109.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.36.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 105.104.123.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 99.113.223.173.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 119.110.54.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 250.255.255.239.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.232.18.117.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 254.132.255.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.143.101.95.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 126.131.241.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.4.107.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.232.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 32.143.101.95.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.208.79.178.in-addr.arpa | udp |
| SG | 8.241.131.126:80 | tcp |
Files
memory/2900-133-0x0000000000140000-0x00000000002D8000-memory.dmp