Malware Analysis Report

2024-10-23 20:15

Sample ID 241015-rb6hjsybjd
Target mesh.bin
SHA256 8e088bcdbdb7d2e9fe7ce1c03762b3a90863ae468db3c2322d48d521a155718a
Tags
loby meshagent execution
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8e088bcdbdb7d2e9fe7ce1c03762b3a90863ae468db3c2322d48d521a155718a

Threat Level: Known bad

The file mesh.bin was found to be: Known bad.

Malicious Activity Summary

loby meshagent execution

Detects MeshAgent payload

Meshagent family

Checks computer location settings

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-15 14:02

Signatures

Detects MeshAgent payload

Description Indicator Process Target
N/A N/A N/A N/A

Meshagent family

meshagent

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-15 14:02

Reported

2024-10-15 14:05

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\mesh.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\mesh.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Users\Admin\AppData\Local\Temp\mesh.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133734745749280796" C:\Users\Admin\AppData\Local\Temp\mesh.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\mesh.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Windows\system32\notepad.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4788 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\mesh.exe C:\Windows\system32\wbem\wmic.exe
PID 4788 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\mesh.exe C:\Windows\system32\wbem\wmic.exe
PID 4788 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\mesh.exe C:\Users\Admin\AppData\Local\Temp\mesh.exe
PID 4788 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\mesh.exe C:\Users\Admin\AppData\Local\Temp\mesh.exe
PID 3704 wrote to memory of 4748 N/A C:\Users\Admin\AppData\Local\Temp\mesh.exe C:\Windows\System32\wbem\wmic.exe
PID 3704 wrote to memory of 4748 N/A C:\Users\Admin\AppData\Local\Temp\mesh.exe C:\Windows\System32\wbem\wmic.exe
PID 3704 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\mesh.exe C:\Windows\system32\wbem\wmic.exe
PID 3704 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\mesh.exe C:\Windows\system32\wbem\wmic.exe
PID 3704 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\mesh.exe C:\Windows\System32\wbem\wmic.exe
PID 3704 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\mesh.exe C:\Windows\System32\wbem\wmic.exe
PID 3704 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\mesh.exe C:\Windows\system32\wbem\wmic.exe
PID 3704 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\mesh.exe C:\Windows\system32\wbem\wmic.exe
PID 3704 wrote to memory of 3464 N/A C:\Users\Admin\AppData\Local\Temp\mesh.exe C:\Windows\System32\wbem\wmic.exe
PID 3704 wrote to memory of 3464 N/A C:\Users\Admin\AppData\Local\Temp\mesh.exe C:\Windows\System32\wbem\wmic.exe
PID 3704 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\mesh.exe C:\Windows\System32\wbem\wmic.exe
PID 3704 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\mesh.exe C:\Windows\System32\wbem\wmic.exe
PID 3704 wrote to memory of 3096 N/A C:\Users\Admin\AppData\Local\Temp\mesh.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3704 wrote to memory of 3096 N/A C:\Users\Admin\AppData\Local\Temp\mesh.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3704 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\mesh.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3704 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\mesh.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3704 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\mesh.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3704 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\mesh.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3704 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\mesh.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3704 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\mesh.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3704 wrote to memory of 4664 N/A C:\Users\Admin\AppData\Local\Temp\mesh.exe C:\Windows\system32\cmd.exe
PID 3704 wrote to memory of 4664 N/A C:\Users\Admin\AppData\Local\Temp\mesh.exe C:\Windows\system32\cmd.exe
PID 4664 wrote to memory of 4852 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\manage-bde.exe
PID 4664 wrote to memory of 4852 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\manage-bde.exe
PID 3704 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\mesh.exe C:\Windows\system32\cmd.exe
PID 3704 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\mesh.exe C:\Windows\system32\cmd.exe
PID 1364 wrote to memory of 628 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\manage-bde.exe
PID 1364 wrote to memory of 628 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\manage-bde.exe

Processes

C:\Users\Admin\AppData\Local\Temp\mesh.exe

"C:\Users\Admin\AppData\Local\Temp\mesh.exe"

C:\Windows\system32\wbem\wmic.exe

wmic os get oslanguage /FORMAT:LIST

C:\Users\Admin\AppData\Local\Temp\mesh.exe

"C:\Users\Admin\AppData\Local\Temp\mesh.exe" connect --disableUpdate=1 --hideConsole=1 --exitPID=4788

C:\Windows\System32\wbem\wmic.exe

wmic SystemEnclosure get ChassisTypes

C:\Windows\system32\wbem\wmic.exe

wmic os get oslanguage /FORMAT:LIST

C:\Windows\System32\wbem\wmic.exe

wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"

C:\Windows\system32\wbem\wmic.exe

wmic os get oslanguage /FORMAT:LIST

C:\Windows\System32\wbem\wmic.exe

wmic SystemEnclosure get ChassisTypes

C:\Windows\System32\wbem\wmic.exe

wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -noprofile -nologo -command -

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -noprofile -nologo -command -

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -noprofile -nologo -command -

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -noprofile -nologo -command -

C:\Windows\system32\cmd.exe

/c manage-bde -protectors -get C: -Type recoverypassword

C:\Windows\system32\manage-bde.exe

manage-bde -protectors -get C: -Type recoverypassword

C:\Windows\system32\cmd.exe

/c manage-bde -protectors -get F: -Type recoverypassword

C:\Windows\system32\manage-bde.exe

manage-bde -protectors -get F: -Type recoverypassword

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Desktop\UseSelect.ocx"

C:\Windows\system32\notepad.exe

"C:\Windows\system32\notepad.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
NL 185.238.2.165:443 tcp
US 8.8.8.8:53 165.2.238.185.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 99.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

memory/3096-30-0x000002935B860000-0x000002935B882000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kus5p3vn.bei.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3096-35-0x000002935BF90000-0x000002935BFD4000-memory.dmp

memory/3096-36-0x000002935BFE0000-0x000002935C056000-memory.dmp

memory/3096-40-0x000002935B890000-0x000002935BAAC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\mesh.db.tmp

MD5 1631c517e09b2615adac5d22600a3c29
SHA1 1f640d9fcd227fd59242b5896d50b3335e5099d3
SHA256 8f01c3af32f74feaf658e5735c5403fe234a14ecf13ab526728234d123d70d16
SHA512 b82e9bd60aa3f32bef6d361e4784fb6e553c18d0b71f8cca73856807ea796b8a76be4cbabd57135565ec0c8580c5a1cad6e3a900371007a0e4413188e6d344c8

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 06d16fea6ab505097d16fcaa32949d47
SHA1 0c1c719831fa41cd102d0d72d61c0f46ec5b8de8
SHA256 54e15de2bef9f651d7717e2a336ac6b2ea2b723e6f29d2b153d8fbbc89aef723
SHA512 03c00f1eebb51cec11703141ae9d9c3ac589f5495bc04d8a4b043714089a9d50bd3a520e4d72b4a4c99f5b9bf5f689bf2585fa5c7d4ddbe6f71cbba0172f593a

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 f2329759d5195d9bc1956de05b112aab
SHA1 4c0cc1b12a0f7b2e5f89b248c354f36acb3631f3
SHA256 5485280090bd71cdbbb07f4fce6efec651065fa257aa14160327632dee1bfeca
SHA512 2c5b4db3a88555f2059252d954b3d49f7dfd1ce8fa62484859a6507899382594611bdddbafbf77134b5270c7ad45990f44f1528654e8b0aace843f7edf67e6b5

memory/2032-60-0x000001C0D8A70000-0x000001C0D8C8C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 9d643a54ad9f8c54f49c0a2052d9c135
SHA1 781ef96740afa86ef33c68ed123cd2ac92bfd273
SHA256 6586bb3241194de4c1b0ab3aa68082fc34a04c209de79f3fd78262cd7c84b18b
SHA512 778a8caf7c7b1c2793ccb23b97a4c9122991741ad53e5f966bd2468458b5a8ab8ed635c6f7cc68dc5839b46e2358f962cd3db0ca23807f0338ae1425de19ea57

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 013e7fbaca9ca5159fb32c493912b0b8
SHA1 cf246aee873a6f3d22ce124331ae6498c5c40ecc
SHA256 d86e135987a39b98666fdebdb0c4a72c7d677246e8bcda8b380513fd167bfbc4
SHA512 5699692fb7cdd396115f28e15d9ab66db1e1729e88373d48b4a1c5c4beefae5237756b21823379f80ebc4e20668f10d3012b0401eb4e899c0f7276fd3397ce47

memory/2276-85-0x0000016FB1710000-0x0000016FB171A000-memory.dmp

memory/2276-86-0x0000016FB1B00000-0x0000016FB1B2A000-memory.dmp

memory/2276-87-0x0000016FB1B00000-0x0000016FB1B24000-memory.dmp