Analysis

  • max time kernel
    91s
  • max time network
    284s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    25-09-2024 07:28

General

  • Target

    QS1.exe

  • Size

    3.3MB

  • MD5

    407da4828b3b9126d6a0b6aa25a081c4

  • SHA1

    3aeee655ab024657da645f9a05b53d40c9456d76

  • SHA256

    a262b898726cdc4e487a7cbaa3d6440496897a2b406e0a049becb91d288eb0c2

  • SHA512

    6f0fa435233a357e5c93f54b5d82a85ac9df1be8150a94ba47ac7920cdac50c7b630a89faa20509f369b9cb49314734e038c677f4c0ed7431847720825df489d

  • SSDEEP

    49152:hX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85Qu:hlRsZ47/QXoHUOfAoj1x6u

Malware Config

Extracted

Family

meshagent

Version

2

Botnet

QS1

C2

http://mc.kaminet.eu:443/agent.ashx

Attributes
  • mesh_id

    0xEE89D60F5CD6BC8AD4C27EB31F4E89CB92C52B0E217F715BD63BD9491D17D4F7427AB13D0C72EA406672528F6DC79861

  • server_id

    A417F6622B66C84C5A6A0F6363F7C42AB877B26FD42E54C556B38C8026CBA894EE3DA91B087D9EC0AB62208B541506F6

  • wss

    wss://mc.kaminet.eu:443/agent.ashx

Signatures

  • Detects MeshAgent payload 1 IoCs
  • MeshAgent

    MeshAgent is an open source remote access trojan written in C++.

  • Sets service image path in registry 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 6 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\QS1.exe
    "C:\Users\Admin\AppData\Local\Temp\QS1.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1148
    • C:\Windows\system32\wbem\wmic.exe
      wmic os get oslanguage /FORMAT:LIST
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3180
    • C:\Users\Admin\AppData\Local\Temp\QS1.exe
      "C:\Users\Admin\AppData\Local\Temp\QS1.exe" -fullinstall
      2⤵
      • Sets service image path in registry
      • Drops file in Program Files directory
      PID:4452
  • C:\Program Files\Mesh Agent\MeshAgent.exe
    "C:\Program Files\Mesh Agent\MeshAgent.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:4332
    • C:\Windows\System32\wbem\wmic.exe
      wmic SystemEnclosure get ChassisTypes
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4168
    • C:\Windows\system32\wbem\wmic.exe
      wmic os get oslanguage /FORMAT:LIST
      2⤵
        PID:1252
      • C:\Windows\System32\wbem\wmic.exe
        wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"
        2⤵
          PID:1048
        • C:\Windows\system32\wbem\wmic.exe
          wmic os get oslanguage /FORMAT:LIST
          2⤵
            PID:872
          • C:\Windows\System32\wbem\wmic.exe
            wmic SystemEnclosure get ChassisTypes
            2⤵
              PID:1996
            • C:\Windows\System32\wbem\wmic.exe
              wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"
              2⤵
                PID:2060
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -noprofile -nologo -command -
                2⤵
                • Drops file in System32 directory
                • Command and Scripting Interpreter: PowerShell
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                PID:1676
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -noprofile -nologo -command -
                2⤵
                • Drops file in System32 directory
                • Command and Scripting Interpreter: PowerShell
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                PID:5536
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -noprofile -nologo -command -
                2⤵
                • Command and Scripting Interpreter: PowerShell
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                PID:2964
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -noprofile -nologo -command -
                2⤵
                • Drops file in System32 directory
                • Command and Scripting Interpreter: PowerShell
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                PID:5104
              • C:\Windows\system32\cmd.exe
                /c manage-bde -protectors -get C: -Type recoverypassword
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:3444
                • C:\Windows\system32\manage-bde.exe
                  manage-bde -protectors -get C: -Type recoverypassword
                  3⤵
                    PID:5020
                • C:\Windows\system32\cmd.exe
                  /c manage-bde -protectors -get F: -Type recoverypassword
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2484
                  • C:\Windows\system32\manage-bde.exe
                    manage-bde -protectors -get F: -Type recoverypassword
                    3⤵
                      PID:5192

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Program Files\Mesh Agent\MeshAgent.db.tmp

                  Filesize

                  151KB

                  MD5

                  0717e2bbee03d2f5184a3dfdd7954951

                  SHA1

                  162452e62fd2e78efc53debf803238744008069f

                  SHA256

                  e0cc8f974f973108636dc2be1631f7cf8cd42e659081def8ef84351b58b6d544

                  SHA512

                  626dea9ef891b000e42afbd879a5f50b428ba9c4ed85263e86d5f36905c8b4ae62798a176513fa57bcb17b1a746cd9bfad92a596d5eb0a4917f9701e5f89179a

                • C:\Program Files\Mesh Agent\MeshAgent.exe

                  Filesize

                  3.3MB

                  MD5

                  407da4828b3b9126d6a0b6aa25a081c4

                  SHA1

                  3aeee655ab024657da645f9a05b53d40c9456d76

                  SHA256

                  a262b898726cdc4e487a7cbaa3d6440496897a2b406e0a049becb91d288eb0c2

                  SHA512

                  6f0fa435233a357e5c93f54b5d82a85ac9df1be8150a94ba47ac7920cdac50c7b630a89faa20509f369b9cb49314734e038c677f4c0ed7431847720825df489d

                • C:\Windows\Temp\__PSScriptPolicyTest_sc1twoyd.imz.ps1

                  Filesize

                  60B

                  MD5

                  d17fe0a3f47be24a6453e9ef58c94641

                  SHA1

                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                  SHA256

                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                  SHA512

                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                  Filesize

                  2KB

                  MD5

                  88dc70c361a22feac57b031dd9c1f02f

                  SHA1

                  a9b4732260c2a323750022a73480f229ce25d46d

                  SHA256

                  43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59

                  SHA512

                  19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c

                • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                  Filesize

                  1KB

                  MD5

                  9274c2c9a4e2973024a6a45cc59ea982

                  SHA1

                  9d8dc5f596e8384fd2e97f77531b83855033544b

                  SHA256

                  23575f692024020e1cbc6f716ca9aedb436d06f7fff1088109561374ed045d05

                  SHA512

                  66560f9001c15d4bde5d44a535e7e0fc153423c6af1337f1204b919535f2ec480b71b022f4101841baf1b61ea62d5714aaf860a2aa4e1899b5285ad4be7a6c75

                • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                  Filesize

                  1KB

                  MD5

                  27c89c41a1eaa307b93a14b61197b717

                  SHA1

                  ae17aa045f1cc8875842bad7537cd4ce30c81294

                  SHA256

                  f36e4bc274085c7afed3372be7dee8e376ef53b63955922c70077db59b1fcdb4

                  SHA512

                  5bc44126b73110103df9260dacacf21ecf396c8fc9bc0d9479e6b28ae8520eb258bbd98b0c3450ec099c646654e4bd4a5a4ac98fb60d1e488b0a12a4f5c70daa

                • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                  Filesize

                  1KB

                  MD5

                  36689773469dd22140cd5fb2e0fe159f

                  SHA1

                  37ff6fc154f5f1c2c86835d2383e1deb06415f87

                  SHA256

                  be2185c5181d3af79bd6b6e566d923850b3ec7ec1253952fc7c7b2a97e844aa4

                  SHA512

                  8cd7847540bcf5e4ba3904469af1c1418730a026b4caacd279181b1e51665c205f7abf5407a24632d1c3832060967db70658ea732114d878e9adea6ff7e30281

                • memory/1676-36-0x0000025A606B0000-0x0000025A606D2000-memory.dmp

                  Filesize

                  136KB

                • memory/1676-37-0x0000025A60AB0000-0x0000025A60AF6000-memory.dmp

                  Filesize

                  280KB

                • memory/2964-94-0x000001AEFB720000-0x000001AEFB72A000-memory.dmp

                  Filesize

                  40KB

                • memory/5104-115-0x00000204E9720000-0x00000204E974A000-memory.dmp

                  Filesize

                  168KB

                • memory/5104-116-0x00000204E9720000-0x00000204E9744000-memory.dmp

                  Filesize

                  144KB

                • memory/5536-69-0x0000019CB1430000-0x0000019CB144C000-memory.dmp

                  Filesize

                  112KB

                • memory/5536-72-0x0000019CB1420000-0x0000019CB1428000-memory.dmp

                  Filesize

                  32KB

                • memory/5536-73-0x0000019CB1450000-0x0000019CB1456000-memory.dmp

                  Filesize

                  24KB

                • memory/5536-74-0x0000019CB1460000-0x0000019CB146A000-memory.dmp

                  Filesize

                  40KB

                • memory/5536-71-0x0000019CB1470000-0x0000019CB148A000-memory.dmp

                  Filesize

                  104KB

                • memory/5536-70-0x0000019CB1410000-0x0000019CB141A000-memory.dmp

                  Filesize

                  40KB

                • memory/5536-68-0x0000019CB11D0000-0x0000019CB11DA000-memory.dmp

                  Filesize

                  40KB

                • memory/5536-67-0x0000019CB1350000-0x0000019CB1403000-memory.dmp

                  Filesize

                  716KB

                • memory/5536-66-0x0000019CB1330000-0x0000019CB134C000-memory.dmp

                  Filesize

                  112KB