Malware Analysis Report

2024-09-11 01:39

Sample ID 240115-mjzmrafbc2
Target 21ab6e4cfe7a17c6fca334c920cd73dbbfac79ce881403b540c8001ae1aae010
SHA256 21ab6e4cfe7a17c6fca334c920cd73dbbfac79ce881403b540c8001ae1aae010
Tags
agenda ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

21ab6e4cfe7a17c6fca334c920cd73dbbfac79ce881403b540c8001ae1aae010

Threat Level: Known bad

The file 21ab6e4cfe7a17c6fca334c920cd73dbbfac79ce881403b540c8001ae1aae010 was found to be: Known bad.

Malicious Activity Summary

agenda ransomware

Agenda Ransomware

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-01-15 10:30

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-15 10:30

Reported

2024-01-15 10:33

Platform

win10-20231215-en

Max time kernel

126s

Max time network

136s

Command Line

"C:\Users\Admin\AppData\Local\Temp\21ab6e4cfe7a17c6fca334c920cd73dbbfac79ce881403b540c8001ae1aae010.exe"

Signatures

Agenda Ransomware

ransomware agenda

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1564 wrote to memory of 3364 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\21ab6e4cfe7a17c6fca334c920cd73dbbfac79ce881403b540c8001ae1aae010.exe
PID 1564 wrote to memory of 3364 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\21ab6e4cfe7a17c6fca334c920cd73dbbfac79ce881403b540c8001ae1aae010.exe
PID 1564 wrote to memory of 3364 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\21ab6e4cfe7a17c6fca334c920cd73dbbfac79ce881403b540c8001ae1aae010.exe
PID 1564 wrote to memory of 4720 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\21ab6e4cfe7a17c6fca334c920cd73dbbfac79ce881403b540c8001ae1aae010.exe
PID 1564 wrote to memory of 4720 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\21ab6e4cfe7a17c6fca334c920cd73dbbfac79ce881403b540c8001ae1aae010.exe
PID 1564 wrote to memory of 4720 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\21ab6e4cfe7a17c6fca334c920cd73dbbfac79ce881403b540c8001ae1aae010.exe

Processes

C:\Users\Admin\AppData\Local\Temp\21ab6e4cfe7a17c6fca334c920cd73dbbfac79ce881403b540c8001ae1aae010.exe

"C:\Users\Admin\AppData\Local\Temp\21ab6e4cfe7a17c6fca334c920cd73dbbfac79ce881403b540c8001ae1aae010.exe"

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe"

C:\Users\Admin\AppData\Local\Temp\21ab6e4cfe7a17c6fca334c920cd73dbbfac79ce881403b540c8001ae1aae010.exe

21ab6e4cfe7a17c6fca334c920cd73dbbfac79ce881403b540c8001ae1aae010.exe -password AgendaPass

C:\Users\Admin\AppData\Local\Temp\21ab6e4cfe7a17c6fca334c920cd73dbbfac79ce881403b540c8001ae1aae010.exe

21ab6e4cfe7a17c6fca334c920cd73dbbfac79ce881403b540c8001ae1aae010.exe --password AgendaPass

Network

Country Destination Domain Proto
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 7.173.189.20.in-addr.arpa udp

Files

memory/3628-0-0x0000000010000000-0x00000000103B3000-memory.dmp

memory/3628-10-0x0000000000810000-0x0000000000C15000-memory.dmp

memory/3364-11-0x0000000010000000-0x00000000103B3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\QLOG\ThreadId(1).LOG

MD5 010069f4e6a1b1a8a86694a059d5be03
SHA1 a91207db467e3b4197c85503d8a45305a380be7c
SHA256 920662f12fd1833f3464b42337d11efb82a4b50153c3c4904bf52dff91d37ab7
SHA512 206bdc9ce40fafbca799bf6e07d43045ccdc764d935a375565788a7c7ae1369006b27cabace9b62a1e2e05b5e2422f97fd26060c6c8ea63bb25c352a29703d3b

memory/3364-26-0x0000000000810000-0x0000000000C15000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\QLOG\ThreadId(1).LOG

MD5 2108f0dc921ab153960fe9aa23392539
SHA1 62a36f1af59774f342a261f5878f79362f1a38f5
SHA256 432ad3f661d33be475932a77c3cf2fe6cd27c8659be8d211ae77b0bf55ee23b0
SHA512 0e0aae09f4183de065668a06c246242300a573ebdcbc9df51282481725c3975986edab52dee2f22c91c2f3f1e0c2b6accf81a4a3b8cf66d672bdc9c211b86072

memory/4720-41-0x0000000000810000-0x0000000000C15000-memory.dmp