G:\Coding\Presidio\bin\Staging\PresidioAgent.pdb
Static task
static1
Behavioral task
behavioral1
Sample
PresidioAgent.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
PresidioAgent.exe
Resource
win10v2004-20240226-en
General
-
Target
PresidioAgent.exe
-
Size
1.4MB
-
MD5
71d064942400360281c3eeef0fdc7d87
-
SHA1
d932d8eac2ac03adff43cb1090dbe128543d810a
-
SHA256
e307173b14c01e12206cd85c86c6600f7f939a67fa55e512b90c4d9c62ebda34
-
SHA512
76d52af6b868b1a99a2a9eb9a83a32f56777dc565cee1a42860e67968160ce000f9d3b4475835d513552b7910c5426610e4672e82bce63b9899ecb49bda2e93a
-
SSDEEP
24576:O/XkJggcSq/lE6vriTryRUluWG2h0lhSMXl49nrjc:O/XkJgRSq/K6IufDt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource PresidioAgent.exe
Files
-
PresidioAgent.exe.exe windows:6 windows x64 arch:x64
6fdf489b935d5e8785a342379782b1fa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
CloseHandle
SetEnvironmentVariableA
GetCurrentProcessId
GetSystemTime
SetUnhandledExceptionFilter
GetLastError
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
SetLastError
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryExW
CreateFileA
GetModuleHandleA
GetCurrentThreadId
GetCurrentProcess
HeapSize
WriteConsoleW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
HeapReAlloc
SetStdHandle
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
HeapFree
HeapAlloc
SetFilePointerEx
GetFileSizeEx
GetCommandLineW
GetCommandLineA
GetStdHandle
GetModuleFileNameW
ExitProcess
GetConsoleOutputCP
WriteFile
GetConsoleMode
WaitForSingleObject
GetProcessHeap
GetCurrentThread
RaiseException
FindClose
FindNextFileW
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
CreateFileW
FindFirstFileExW
InitOnceComplete
InitOnceBeginInitialize
GetStringTypeW
WaitForSingleObjectEx
GetExitCodeThread
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
GetCPInfo
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
SetEnvironmentVariableW
GetFileType
user32
wsprintfA
MessageBoxA
ws2_32
WSAGetLastError
WSAWaitForMultipleEvents
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
WSASetLastError
select
__WSAFDIsSet
dbghelp
MiniDumpWriteDump
ntdll
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
Sections
.text Size: 646KB - Virtual size: 646KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 745KB - Virtual size: 745KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ