Overview

overview

4

Static

static

3

TitanAgent...64.exe

windows7-x64

4

TitanAgent...64.exe

windows10-2004-x64

4

$PLUGINSDI...md.dll

windows7-x64

3

$PLUGINSDI...md.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ON.dll

windows7-x64

3

$PLUGINSDI...ON.dll

windows10-2004-x64

3

$PLUGINSDI...nt.dll

windows7-x64

3

$PLUGINSDI...nt.dll

windows10-2004-x64

3

$PLUGINSDI...ce.dll

windows7-x64

3

$PLUGINSDI...ce.dll

windows10-2004-x64

3

$_62_.exe

windows7-x64

1

$_62_.exe

windows10-2004-x64

1

$_63_.exe

windows7-x64

1

$_63_.exe

windows10-2004-x64

1

$_64_.exe

windows7-x64

1

$_64_.exe

windows10-2004-x64

1

scanmanager.exe

windows7-x64

1

scanmanager.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    93s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/10/2024, 19:15 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    TitanAgent_for_All_x86_64.exe

  • Size

    12.4MB

  • MD5

    db6458f916dc27495c5f6e7cffd9d7dd

  • SHA1

    04d475841fdc96d4c782a2d2b8c7951acf040bb7

  • SHA256

    a1e2e862ad2728023156216d4a7d14e2ee165aa138393baba84971af28900b98

  • SHA512

    d4f98aa4b12cccb66f5b6aaccc7f8ac936040afc1df990133b2cfc94c0451833730de4748867c9f8ce65212cd4e505af1bd7c40b1f764141f3d02e8db757a713

  • SSDEEP

    393216:Jijw841C5vSFp1bC4lqZgLCzfVWLQkfNPa2d:QjwuviwZ26tw

Score
4/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\TitanAgent_for_All_x86_64.exe
    "C:\Users\Admin\AppData\Local\Temp\TitanAgent_for_All_x86_64.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:2628

Network

  • flag-us
    DNS
    133.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    226.108.222.173.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    226.108.222.173.in-addr.arpa
    IN PTR
    Response
    226.108.222.173.in-addr.arpa
    IN PTR
    a173-222-108-226deploystaticakamaitechnologiescom
  • flag-us
    DNS
    26.35.223.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    26.35.223.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    53.210.109.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    53.210.109.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    241.42.69.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.42.69.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    70.209.201.84.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    70.209.201.84.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    99.209.201.84.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    99.209.201.84.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    19.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    19.229.111.52.in-addr.arpa
    IN PTR
    Response
No results found
  • 8.8.8.8:53
    133.32.126.40.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    133.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    226.108.222.173.in-addr.arpa
    dns
    74 B
     141 B
     1
    1

    DNS Request

    226.108.222.173.in-addr.arpa

  • 8.8.8.8:53
    26.35.223.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    26.35.223.20.in-addr.arpa

  • 8.8.8.8:53
    53.210.109.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    53.210.109.20.in-addr.arpa

  • 8.8.8.8:53
    241.42.69.40.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    241.42.69.40.in-addr.arpa

  • 8.8.8.8:53
    70.209.201.84.in-addr.arpa
    dns
    72 B
     132 B
     1
    1

    DNS Request

    70.209.201.84.in-addr.arpa

  • 8.8.8.8:53
    99.209.201.84.in-addr.arpa
    dns
    72 B
     132 B
     1
    1

    DNS Request

    99.209.201.84.in-addr.arpa

  • 8.8.8.8:53
    19.229.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    19.229.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nswBD65.tmp\LangDLL.dll
    Filesize

    5KB

    MD5

    77ff758c10c66937de6d86c388aa431c

    SHA1

    14bd5628eaf8a12b55cd38f9560c839cb21ce77a

    SHA256

    6a033e367714ec0d13fca0589c165bdbf4d1dac459fa7ec7415815223fa3c008

    SHA512

    319837951be276a179ead69efcd24bd7566061abc7997ea782af50bd4b0d69e5ec1a6e4cdeb2825bafedf87edf03380396b7bcf58682b6a3a824c8dc4b966bda

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nswBD65.tmp\System.dll
    Filesize

    11KB

    MD5

    b0c77267f13b2f87c084fd86ef51ccfc

    SHA1

    f7543f9e9b4f04386dfbf33c38cbed1bf205afb3

    SHA256

    a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77

    SHA512

    f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nswBD65.tmp\nsDialogs.dll
    Filesize

    9KB

    MD5

    eac1c3707970fe7c71b2d760c34763fa

    SHA1

    f275e659ad7798994361f6ccb1481050aba30ff8

    SHA256

    062c75ad650548750564ffd7aef8cd553773b5c26cae7f25a5749b13165194e3

    SHA512

    3415bd555cf47407c0ae62be0dbcba7173d2b33a371bf083ce908fc901811adb888b7787d11eb9d99a1a739cbd9d1c66e565db6cd678bdadaf753fbda14ffd09

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.