AgentSetup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
AgentSetup.exe
Size 213.4MB
Sample240323-snmrmsbe6s
SHA256 72ec6f81b0de47f93bb8941bd86a10377a0bd6e5f188120679396ede0886a4b3
MD5 f9dbbde616f4fe8711cbc1a3fa120deb
SHA1 39d5cb442442002ee31ed827ca573f0dd35f704e
SHA512 481eaee2cfbbf8cae9b3894c8e964de66bd6c22c8e8c907c66c1e15e29665f55bcecab524c060ef364f21cfb13c360f9d0b1c72c2d955a08292cf1026b365d0c
SSDEEP 3145728:k6o6gaBwQG+sqLnCsSgPCFT9wSeoqOCJT/LcMP4ld6nO7uro6ymPNWeAwdloFLeS:Mv+sqTCsv2eSyp/LcI4KnTsPmPIwdVxQ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
AgentSetup.exe
unpack001/$TEMP/WindowsUpdates.exe

File Explorer

AgentSetup.exe

.exe 213.4MB
$TEMP/AgentSetup.exe

.exe 215.8MB
$TEMP/WindowsUpdates.exe

.exe 487KB

AgentSetup.exe

IMPHASH 56a78d55f3f7af51443e58e0ce2fb5f6
SHA256 72ec6f81b0de47f93bb8941bd86a10377a0bd6e5f188120679396ede0886a4b3
MD5 f9dbbde616f4fe8711cbc1a3fa120deb
SHA1 39d5cb442442002ee31ed827ca573f0dd35f704e
SHA512 481eaee2cfbbf8cae9b3894c8e964de66bd6c22c8e8c907c66c1e15e29665f55bcecab524c060ef364f21cfb13c360f9d0b1c72c2d955a08292cf1026b365d0c
SSDEEP 3145728:k6o6gaBwQG+sqLnCsSgPCFT9wSeoqOCJT/LcMP4ld6nO7uro6ymPNWeAwdloFLeS:Mv+sqTCsv2eSyp/LcI4KnTsPmPIwdVxQ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13613

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$TEMP/AgentSetup.exe

IMPHASH 18b31546654757186c18a83004821b2a
SHA256 84372730101078190450b74595424f2cee64e2563ce8f024fce69e9206ba42e4
MD5 6f669ab8685bc09de164bdbdd4f378f1
SHA1 89bccf94119ff5e82e0cbfc22846367b897bb2a9
SHA512 cc7386cd2e4830ea293e4ef133790ba50ea68318b091ad04bf4cd8d2f84591c21e7e5a7cca4c1560fa84dbadb37c2540cdb36e2ba71ba073e755f3a17316e4a7
SSDEEP 6291456:OgWtYiMKyaDkSyq1R4YWeKejXQHUX2MP4Xs:TYY9GkSyWPfjgW2MQ8
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

PE Signature issue

Digest

35:1e:29:a7:dd:3d:ca:ff:3e:2c:44:5f:bf:50:ad:c1:b7:e8:88:65:0e:f3:a3:da:ce:19:43:f4:e6:64:a3:5b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Acunetix Ltd.,OU=Acunetix Development Department,O=Acunetix Ltd.,L=St. Julians\,,ST=Malta,C=MT

Chains

Jun 25, 2020

PE Signature issue

Digest

30:35:d5:9e:75:f8:47:68:3a:6f:91:61:ff:c3:c7:90:65:44:1c:4c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Acunetix Ltd.,OU=Acunetix Development Department,O=Acunetix Ltd.,L=St. Julians\,,ST=Malta,C=MT

Chains

Jun 25, 2020

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Serial Number

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Acunetix Ltd.,OU=Acunetix Development Department,O=Acunetix Ltd.,L=St. Julians\,,ST=Malta,C=MT

Serial Number

64:10:97:25:88:16:5c:dd:af:77:1d:b2:c8:f5:3e:00

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 8, 2018 - Jun 27, 2020

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Serial Number

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Acunetix Ltd.,OU=Acunetix Development Department,O=Acunetix Ltd.,L=St. Julians\,,ST=Malta,C=MT

Serial Number

64:10:97:25:88:16:5c:dd:af:77:1d:b2:c8:f5:3e:00

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 8, 2018 - Jun 27, 2020

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

1172947

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdb

kernel32

CreateFileW CloseHandle WriteFile DeleteFileW HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap RemoveDirectoryW GetTempPathW GetTempFileNameW CreateDirectoryW MoveFileW GetLastError SizeofResource LockResource LoadResource FindResourceW FindResourceExW EnterCriticalSection LeaveCriticalSection GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetCurrentThreadId RaiseException SetLastError GlobalUnlock GlobalLock GlobalAlloc MulDiv lstrcmpW CreateEventW SetEvent InitializeCriticalSection lstrcpynW WaitForSingleObject CreateThread GetProcAddress LoadLibraryExW DecodePointer Sleep GetDiskFreeSpaceExW GetExitCodeThread GetCurrentProcessId FreeLibrary GetSystemDirectoryW lstrlenW VerifyVersionInfoW VerSetConditionMask lstrcmpiW GetModuleHandleW LoadLibraryW GetDriveTypeW CompareStringW FindFirstFileW FindNextFileW GetLogicalDriveStringsW GetFileSize GetFileAttributesW SetFileAttributesW GetFileTime CopyFileW ReadFile SetFilePointer FindClose MultiByteToWideChar WideCharToMultiByte GetCurrentProcess GetSystemInfo WaitForMultipleObjects ReadConsoleW VirtualProtect VirtualQuery LoadLibraryExA GetStringTypeW GetShortPathNameW SetUnhandledExceptionFilter GetEnvironmentVariableW GetEnvironmentStringsW FormatMessageW LocalFree LoadLibraryA GetModuleFileNameA GetFullPathNameW GetCurrentThread FlushFileBuffers SetConsoleTextAttribute GetStdHandle GetConsoleScreenBufferInfo OutputDebugStringW CreateProcessW GetExitCodeProcess GetTickCount GetCommandLineW SetCurrentDirectoryW SetEndOfFile EnumResourceLanguagesW GetLocaleInfoW GetSystemDefaultLangID GetUserDefaultLangID GetWindowsDirectoryW GetSystemTime SystemTimeToFileTime FileTimeToSystemTime CreateToolhelp32Snapshot Process32FirstW Process32NextW ResetEvent GlobalFree GetPrivateProfileStringW GetPrivateProfileSectionNamesW WritePrivateProfileStringW GetLocalTime CreateNamedPipeW ConnectNamedPipe TerminateThread LocalAlloc CompareFileTime CopyFileExW OpenEventW PeekNamedPipe IsDebuggerPresent EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree QueryPerformanceCounter QueryPerformanceFrequency SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetCPInfo LCMapStringW WaitForSingleObjectEx UnhandledExceptionFilter TerminateProcess GetStartupInfoW RtlUnwind ExitProcess GetModuleHandleExW GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleCP GetConsoleMode IsValidCodePage GetACP GetOEMCP GetFileSizeEx SetFilePointerEx FindFirstFileExW GetCommandLineA FreeEnvironmentStringsW SetStdHandle WriteConsoleW

$TEMP/WindowsUpdates.exe

SHA256 8d2f5e538fecbbc4e1b210e46a3ff23e83d3e5d41889620a152d64e5837664f9
MD5 6ff93fe40aac2479a62a5e6a32f96aeb
SHA1 d5bdaca9eac46965b306aba3362fa81c60082d20
SHA512 151c5ddedd0df4866ebac29a75bcd88e50acf50e0087c63455ce6a1a0a706870b74a6e2c86cebf3c4221d800e2715b8fb872d71d884eabddef8e8b8b12e48d79
SSDEEP 12288:zy4elxMgArBBFxw90ZGAfYXQI7nlgMhZY5apWsjZtRupwNz:zy4eMXBsyvfYXQI7tJ7Rv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

AgentSetup.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$TEMP/AgentSetup.exe

PE Signature issue

PE Signature issue

kernel32

generic

$TEMP/WindowsUpdates.exe

generic