Malware Analysis Report

2024-09-11 01:42

Sample ID 240606-gbygtsaf26
Target 17611026749.zip
SHA256 2d77acd4c7b1cbea6844c312ada0d9b01f56a75fc240fd11a992df2011c8be92
Tags
agenda ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2d77acd4c7b1cbea6844c312ada0d9b01f56a75fc240fd11a992df2011c8be92

Threat Level: Known bad

The file 17611026749.zip was found to be: Known bad.

Malicious Activity Summary

agenda ransomware

Agenda Ransomware

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-06 05:38

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-06 05:38

Reported

2024-06-06 05:57

Platform

win7-20240215-en

Max time kernel

117s

Max time network

124s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa0772fc6784799d59649654879c2b4a23919cda410bede0162751e6d6d6b558.dll,#1

Signatures

Agenda Ransomware

ransomware agenda

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2276 wrote to memory of 2244 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2276 wrote to memory of 2244 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2276 wrote to memory of 2244 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2276 wrote to memory of 2244 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2276 wrote to memory of 2244 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2276 wrote to memory of 2244 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2276 wrote to memory of 2244 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa0772fc6784799d59649654879c2b4a23919cda410bede0162751e6d6d6b558.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa0772fc6784799d59649654879c2b4a23919cda410bede0162751e6d6d6b558.dll,#1

Network

N/A

Files

memory/2244-0-0x0000000010000000-0x00000000104B0000-memory.dmp

memory/2244-10-0x0000000073F20000-0x000000007441F000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-06 05:38

Reported

2024-06-06 05:57

Platform

win10v2004-20240426-en

Max time kernel

91s

Max time network

148s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa0772fc6784799d59649654879c2b4a23919cda410bede0162751e6d6d6b558.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4008 wrote to memory of 536 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4008 wrote to memory of 536 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4008 wrote to memory of 536 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa0772fc6784799d59649654879c2b4a23919cda410bede0162751e6d6d6b558.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa0772fc6784799d59649654879c2b4a23919cda410bede0162751e6d6d6b558.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp

Files

memory/536-10-0x00000000753E0000-0x00000000758DF000-memory.dmp

memory/536-0-0x0000000010000000-0x00000000104B0000-memory.dmp