General
-
Target
04db464b6a31437b0932cc3d86b2633c090af01a60423bcbc562364c899f2112N.exe
-
Size
5.0MB
-
Sample
241120-cnhjxsyfpq
-
MD5
d0e9d314c29867185f9e802dcc490060
-
SHA1
497aebefbb560065ab9c29d1faa96c8fed56146c
-
SHA256
04db464b6a31437b0932cc3d86b2633c090af01a60423bcbc562364c899f2112
-
SHA512
8423cfdc2a99806717b588c44bb65eb942aed051dfdb41ebfb3295555c0ed983fcc9d007c28b05b7eb9e2ba471038a102017fa13e39c756abb136eaa2e7ab317
-
SSDEEP
49152:kgvUDWv4e4uPpV1wrb/T8vO90d7HjmAFd4A64nsfJJKyutrDb4HGw1lfVGlJS5ZL:D4e4uPpVm6gTVGIO7DfE++eC
Static task
static1
Behavioral task
behavioral1
Sample
04db464b6a31437b0932cc3d86b2633c090af01a60423bcbc562364c899f2112N.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
04db464b6a31437b0932cc3d86b2633c090af01a60423bcbc562364c899f2112N.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
meshagent
2
TacticalRMM
http://mesh.beraten-tech.de:443/agent.ashx
-
mesh_id
0xC2DBF8D5176E2795D03D1F2086E24D8503399C5B811169DE7D09CDA90EEF410CBE81B01B8A75A397214216EBA8427CB0
-
server_id
AD48C3AA51248216A8C92D3FC4C1113ED99033BBAA3EAD73F71E07AACE6B685586E90C16830E5A7CE432D425CA12A7C6
-
wss
wss://mesh.beraten-tech.de:443/agent.ashx
Targets
-
-
Target
04db464b6a31437b0932cc3d86b2633c090af01a60423bcbc562364c899f2112N.exe
-
Size
5.0MB
-
MD5
d0e9d314c29867185f9e802dcc490060
-
SHA1
497aebefbb560065ab9c29d1faa96c8fed56146c
-
SHA256
04db464b6a31437b0932cc3d86b2633c090af01a60423bcbc562364c899f2112
-
SHA512
8423cfdc2a99806717b588c44bb65eb942aed051dfdb41ebfb3295555c0ed983fcc9d007c28b05b7eb9e2ba471038a102017fa13e39c756abb136eaa2e7ab317
-
SSDEEP
49152:kgvUDWv4e4uPpV1wrb/T8vO90d7HjmAFd4A64nsfJJKyutrDb4HGw1lfVGlJS5ZL:D4e4uPpVm6gTVGIO7DfE++eC
-
Detects MeshAgent payload
-
Meshagent family
-
Sets service image path in registry
-
Executes dropped EXE
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1