agenda | 2d77acd4c7b1cbea6844c312ada0d9b01f56a75fc240fd11a992df2011c8be92

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
06-06-2024 05:38

Target

aa0772fc6784799d59649654879c2b4a23919cda410bede0162751e6d6d6b558.dll
Size

5.0MB
MD5

440810b008eed766f085b69b1723f54b
SHA1

9692644974071cd484455e355f8d79ce8c486e20
SHA256

aa0772fc6784799d59649654879c2b4a23919cda410bede0162751e6d6d6b558
SHA512

99f37c6f1e31c79836427297a15292e79f3a6dcf90e128ab721bbc57ed8e0ca4ab14d662c74bbf7c9c1c6ae66fb5b772a706d0940b487289f7397d1c15ce67a9
SSDEEP

98304:bMHGypxjgEqr4y5f18zKUC11G5+ovCoTUYPK7RP684:b0/Dj8fBUC1g5+ovC4BPKc84

Score

10^/10

agenda ransomware

Family

agenda

Attributes

company_id
rVA0Ynm3YN
note
-- Qilin Your network/system was encrypted. Encrypted files have new extension. -- Compromising and sensitive data We have downloaded compromising and sensitive data from you system/network If you refuse to communicate with us and we do not come to an agreement, your data will be published. Data includes: - Employees personal data, CVs, DL , SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... -- Warning 1) If you modify files - our decrypt software won't able to recover data 2) If you use third party software - you can damage/modify files (see item 1) 3) You need cipher key / our decrypt software to restore you files. 4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Go to domain 3) Enter credentials -- Backup communication via mail. in case you can't access your personal account - [email protected] Credentials Extension: rVA0Ynm3YN Domain: srb6w7f4y3ldfeb6esog4ttfh4mqttwyppihwuvjsnviq6z3e52qsyqd.onion login: XQblMmOaQgsylN2zRnn2wNVae7OOuncb password:

rsa_pubkey.plain

Agenda Ransomware
A ransomware with multiple variants written in Golang and Rust first seen in August 2022.
ransomware agenda

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2244	2276	rundll32.exe	28
PID 2276 wrote to memory of 2244	2276	rundll32.exe	28
PID 2276 wrote to memory of 2244	2276	rundll32.exe	28
PID 2276 wrote to memory of 2244	2276	rundll32.exe	28
PID 2276 wrote to memory of 2244	2276	rundll32.exe	28
PID 2276 wrote to memory of 2244	2276	rundll32.exe	28
PID 2276 wrote to memory of 2244	2276	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa0772fc6784799d59649654879c2b4a23919cda410bede0162751e6d6d6b558.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa0772fc6784799d59649654879c2b4a23919cda410bede0162751e6d6d6b558.dll,#1
  2⤵
  PID:2244

memory/2244-0-0x0000000010000000-0x00000000104B0000-memory.dmp

Filesize
4.7MB

Download
memory/2244-10-0x0000000073F20000-0x000000007441F000-memory.dmp

Filesize
5.0MB

Download