Overview

overview

10

Static

static

1

2024-12-12...ch.exe

windows7-x64

10

2024-12-12...ch.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12-12-2024 19:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-12-12_72bcc1351d9632429245952663a3e264_frostygoop_hijackloader_luca-stealer_poet-rat_snatch.exe

  • Size

    5.0MB

  • MD5

    72bcc1351d9632429245952663a3e264

  • SHA1

    33a30a436b62f3c34630240b156189324a01ec8e

  • SHA256

    6bbdfb603c2f1fa92efe6e09162ff7a8859d31b0547860f59547561ea80c4a8f

  • SHA512

    4b6698b6ce9615d4a9657d827f9a881a6f20ff899071bacfaad0c0de3002257f9c25727d8a8c46dd8a6055823d0bff0fed2d685e9e920f8215793fcb7d186f75

  • SSDEEP

    49152:jRg0nHs3wQuuhrb/T8vO90d7HjmAFd4A64nsfJoRLvXW4uyRcH5g3ZCNUgxocMC6:I3wQuu81n256dgxtrEn+eDP

Score
10/10
meshagenttacticalrmmbackdoordiscoveryevasionexecutionpersistencerattrojan

Malware Config

Extracted

Family

meshagent

Version

2

Botnet

TacticalRMM

C2

http://mesh.rmm.xpertus-service.de:443/agent.ashx

Attributes
  • mesh_id

    0x9AB80AC2C10CC0E60A88AF1959FA7CFA5406C5C075E527EDBA76544D8295DD0A7203B0D6279BE93056216EAE6A484BB3

  • server_id

    62AEF12E4ED2E31BFAE22AF942C5E9BAC419D9BF1B2B4E41B75E0EF6EE6A542634EAC26B2CB1E2E9C1C7905767230610

  • wss

    wss://mesh.rmm.xpertus-service.de:443/agent.ashx

Signatures

  • Detects MeshAgent payload 1 IoCs
  • MeshAgent

    MeshAgent is an open source remote access trojan written in C++.

    rattrojanbackdoormeshagent
  • Meshagent family
    meshagent
  • Blocklisted process makes network request 4 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 6 IoCs
  • Drops file in Program Files directory 21 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Using powershell.exe command.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-12-12_72bcc1351d9632429245952663a3e264_frostygoop_hijackloader_luca-stealer_poet-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-12-12_72bcc1351d9632429245952663a3e264_frostygoop_hijackloader_luca-stealer_poet-rat_snatch.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2092
    • C:\ProgramData\TacticalRMM\tacticalagent-v2.8.0-windows-amd64.exe
      C:\ProgramData\TacticalRMM\tacticalagent-v2.8.0-windows-amd64.exe /VERYSILENT /SUPPRESSMSGBOXES
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2560
      • C:\Users\Admin\AppData\Local\Temp\is-S666E.tmp\tacticalagent-v2.8.0-windows-amd64.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-S666E.tmp\tacticalagent-v2.8.0-windows-amd64.tmp" /SL5="$90194,3660179,825344,C:\ProgramData\TacticalRMM\tacticalagent-v2.8.0-windows-amd64.exe" /VERYSILENT /SUPPRESSMSGBOXES
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:944
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c ping 127.0.0.1 -n 2 && net stop tacticalrpc
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:1152
          • C:\Windows\SysWOW64\PING.EXE
            ping 127.0.0.1 -n 2
            5⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:2268
          • C:\Windows\SysWOW64\net.exe
            net stop tacticalrpc
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2484
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop tacticalrpc
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2892
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c net stop tacticalagent
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2908
          • C:\Windows\SysWOW64\net.exe
            net stop tacticalagent
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3036
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop tacticalagent
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2772
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c ping 127.0.0.1 -n 2 && net stop tacticalrmm
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:2924
          • C:\Windows\SysWOW64\PING.EXE
            ping 127.0.0.1 -n 2
            5⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:2964
          • C:\Windows\SysWOW64\net.exe
            net stop tacticalrmm
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2732
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop tacticalrmm
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1940
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c taskkill /F /IM tacticalrmm.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2624
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM tacticalrmm.exe
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2664
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c sc delete tacticalagent
          4⤵
          • System Location Discovery: System Language Discovery
          PID:664
          • C:\Windows\SysWOW64\sc.exe
            sc delete tacticalagent
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:1088
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c sc delete tacticalrpc
          4⤵
          • System Location Discovery: System Language Discovery
          PID:876
          • C:\Windows\SysWOW64\sc.exe
            sc delete tacticalrpc
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:1064
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c tacticalrmm.exe -m installsvc
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2608
          • C:\Program Files\TacticalAgent\tacticalrmm.exe
            tacticalrmm.exe -m installsvc
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1996
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c net start tacticalrmm
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1992
          • C:\Windows\SysWOW64\net.exe
            net start tacticalrmm
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2144
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 start tacticalrmm
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1964
    • C:\Program Files\TacticalAgent\tacticalrmm.exe
      "C:\Program Files\TacticalAgent\tacticalrmm.exe" -m install --api https://api.rmm.xpertus-service.de --client-id 6 --site-id 42 --agent-type workstation --auth c1d5d1062117beabc5ccad17e8385b7a52dbee34a02f6c9ef622508e880c6108
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1212
      • C:\Program Files\TacticalAgent\meshagent.exe
        "C:\Program Files\TacticalAgent\meshagent.exe" -fullinstall
        3⤵
        • Sets service image path in registry
        • Executes dropped EXE
        • Drops file in Program Files directory
        PID:2864
      • C:\Program Files\Mesh Agent\MeshAgent.exe
        "C:\Program Files\Mesh Agent\MeshAgent.exe" -nodeid
        3⤵
        • Executes dropped EXE
        PID:1336
  • C:\Program Files\Mesh Agent\MeshAgent.exe
    "C:\Program Files\Mesh Agent\MeshAgent.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    PID:2232
    • C:\Windows\System32\wbem\wmic.exe
      wmic SystemEnclosure get ChassisTypes
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1968
    • C:\Windows\system32\wbem\wmic.exe
      wmic os get oslanguage /FORMAT:LIST
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2024
    • C:\Windows\System32\wbem\wmic.exe
      wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1036
    • C:\Windows\system32\wbem\wmic.exe
      wmic os get oslanguage /FORMAT:LIST
      2⤵
        PID:576
    • C:\Program Files\Mesh Agent\MeshAgent.exe
      "C:\Program Files\Mesh Agent\MeshAgent.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Modifies data under HKEY_USERS
      PID:2272
      • C:\Windows\System32\wbem\wmic.exe
        wmic SystemEnclosure get ChassisTypes
        2⤵
          PID:2492
        • C:\Windows\system32\wbem\wmic.exe
          wmic os get oslanguage /FORMAT:LIST
          2⤵
            PID:3064
          • C:\Windows\System32\wbem\wmic.exe
            wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"
            2⤵
              PID:1908
            • C:\Windows\System32\wbem\wmic.exe
              wmic SystemEnclosure get ChassisTypes
              2⤵
                PID:2268
              • C:\Windows\System32\wbem\wmic.exe
                wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"
                2⤵
                  PID:3036
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -noprofile -nologo -command -
                  2⤵
                  • Drops file in Program Files directory
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2924
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -noprofile -nologo -command -
                  2⤵
                  • Drops file in Program Files directory
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1732
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -noprofile -nologo -command -
                  2⤵
                  • Drops file in Program Files directory
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2424
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -noprofile -nologo -command -
                  2⤵
                  • Drops file in Program Files directory
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2560
              • C:\Program Files\TacticalAgent\tacticalrmm.exe
                "C:\Program Files\TacticalAgent\tacticalrmm.exe" -m svc
                1⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Drops file in Program Files directory
                • Drops file in Windows directory
                • Modifies data under HKEY_USERS
                • Modifies system certificate store
                • Suspicious behavior: EnumeratesProcesses
                PID:2940
                • C:\Program Files\Mesh Agent\MeshAgent.exe
                  "C:\Program Files\Mesh Agent\MeshAgent.exe" -nodeid
                  2⤵
                  • Executes dropped EXE
                  PID:1988
                • C:\Program Files\TacticalAgent\tacticalrmm.exe
                  "C:\Program Files\TacticalAgent\tacticalrmm.exe" -m checkrunner
                  2⤵
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1208
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NonInteractive -NoProfile -ExecutionPolicy Bypass C:\ProgramData\TacticalRMM\1172211764.ps1
                  2⤵
                  • Blocklisted process makes network request
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3000

              Network

              MITRE ATT&CK Enterprise v15

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              1
              T1059

              PowerShell

              1
              T1059.001

              System Services

              1
              T1569

              Service Execution

              1
              T1569.002

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Create or Modify System Process

              1
              T1543

              Windows Service

              1
              T1543.003

              Privilege Escalation

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Create or Modify System Process

              1
              T1543

              Windows Service

              1
              T1543.003

              Defense Evasion

              Impair Defenses

              1
              T1562

              Modify Registry

              2
              T1112

              Subvert Trust Controls

              1
              T1553

              Install Root Certificate

              1
              T1553.004

              Credential Access

              Discovery

              Query Registry

              1
              T1012

              Remote System Discovery

              1
              T1018

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              System Network Configuration Discovery

              1
              T1016

              Internet Connection Discovery

              1
              T1016.001

              Lateral Movement

              Collection

              Command and Control

              Exfiltration

              Impact

              Service Stop

              1
              T1489

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files\Mesh Agent\MeshAgent.db
                Filesize

                153KB

                MD5

                05e1a6704cabe3a018e19739aa14bd53

                SHA1

                f8f51d07a8a6dd4167f732f36edda558043406b3

                SHA256

                1e513361dd2d1ad7d22f04ade5aab4dbc63437be78fba3f0327a02245935eab5

                SHA512

                b263f502cefe8b9367a29c78c0a3a3bd829cc4102f31cf6cf1734bc3f292db9e90ee264f6df77ebd957f96c909d68f59073d17ec9ea26b1bbf32034be62c0587

                Download Submit

              • C:\Program Files\Mesh Agent\MeshAgent.msh
                Filesize

                31KB

                MD5

                cf53faccb3535cba0246959c8f475c30

                SHA1

                20652cd5732f0302ea93c40497e3cdba196257cb

                SHA256

                1f137661d66923315cd23063ad29fd01d8d8b87c32a53a9be2894077332d05ed

                SHA512

                6072d0dd63cbe31201abe20d2517734d48c26a9d3c9686713fc4d729c89ddbb6c02d25cc6b4a42461b8321f4fc379fc4ac600ee9c4f646aa228c1ae19bbcad35

                Download Submit

              • C:\Program Files\TacticalAgent\agent.log
                Filesize

                67B

                MD5

                e9b63939a5a8389b4d55af416eade609

                SHA1

                c4beb1dc15bd320a00e8afe9cff393ab2380ddb4

                SHA256

                d842aa223113657ba66a0603348bc75db569b6771a88c26a02aaaf2d69e6c806

                SHA512

                252f2fb2ed99e5c31f4b79a6c8ad30fc86a0b3c695f22bc004d5a86e27138fe886662d514a9f995cbdbeaa16aeca3f36e3b3cb8131c4dee4b2361c5534f482b6

                Download Submit

              • C:\ProgramData\TacticalRMM\1172211764.ps1
                Filesize

                35KB

                MD5

                e9fb33c49bee675e226d1afeef2740d9

                SHA1

                ded4e30152638c4e53db4c3c62a76fe0b69e60ab

                SHA256

                44e045ed5350758616d664c5af631e7f2cd10165f5bf2bd82cbf3a0bb8f63462

                SHA512

                2661a981d48d58c9ceb1992e55061ce07af0d53b5f38b07de620376e0ea1d876c7e50965e67aee80fe723968bdb956dc7fd93e7923608534c8fb4d21739dbc48

                Download Submit

              • C:\ProgramData\TacticalRMM\tacticalagent-v2.8.0-windows-amd64.exe
                Filesize

                4.3MB

                MD5

                2f046950e65922336cd83bf0dbc9de33

                SHA1

                ddc64a8b21c8146c93c0b19c1eeb0ef784b980c6

                SHA256

                412e1f600251b21911c582e69381f677e663231f5e1d10786d88a026e00ea811

                SHA512

                a11cbf8b8b692d2d5a0e3af5a97f91a3d1f3e7aa39966eb7d62b3244b3913f2fdc21823d5c94de0d98e579f801709df44433af91567356361d5d9699a93b2cbc

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\is-S666E.tmp\tacticalagent-v2.8.0-windows-amd64.tmp
                Filesize

                3.0MB

                MD5

                a639312111d278fee4f70299c134d620

                SHA1

                6144ca6e18a5444cdb9b633a6efee67aff931115

                SHA256

                4b0be5167a31a77e28e3f0a7c83c9d289845075b51e70691236603b1083649df

                SHA512

                f47f01d072ff9ed42f5b36600ddfc344a6a4b967c1b671ffc0e76531e360bfd55a1a9950305ad33f7460f3f5dd8953e317b108cd434f2db02987fa018d57437c

                Download Submit

              • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
                Filesize

                914B

                MD5

                e4a68ac854ac5242460afd72481b2a44

                SHA1

                df3c24f9bfd666761b268073fe06d1cc8d4f82a4

                SHA256

                cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

                SHA512

                5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

                Download Submit

              • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                Filesize

                70KB

                MD5

                49aebf8cbd62d92ac215b2923fb1b9f5

                SHA1

                1723be06719828dda65ad804298d0431f6aff976

                SHA256

                b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                SHA512

                bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                Download Submit

              • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
                Filesize

                1KB

                MD5

                a266bb7dcc38a562631361bbf61dd11b

                SHA1

                3b1efd3a66ea28b16697394703a72ca340a05bd5

                SHA256

                df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

                SHA512

                0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

                Download Submit

              • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
                Filesize

                252B

                MD5

                ea6bdd085a910ceedc9c046d1e030852

                SHA1

                e145044fb07b7e63c016def2a14f9f8ebf2204dc

                SHA256

                d4522ccbbf0cbbca0fdb4d6ad1fe762a36f4919abcd072ce173f062ec350ac04

                SHA512

                416784343e5d433d40a23821ad361eb24ce6cbda1aaed1cdb87bdfcad0baa2b272ff7119b0e4ef5e2d9f030b8b4f6effb6577b31ecd270bd0c676c6c3b0d278c

                Download Submit

              • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                Filesize

                342B

                MD5

                3f17b8fd45e907c21e37a8bda22f99a6

                SHA1

                a9df49cdaea33008395ad5ade205cdca96052b2f

                SHA256

                3fc79da049149a04ffa3d6e1d9aa0aa168b2adc556be86c28ba45d6827947c1c

                SHA512

                83185cc13f9d36dc80448ed9714e2f23be03dbe111fe493afb0aff7225affa79f3b55cba55be308dace39facd0dcb70daebcfad09e13bbe4d57eff1fdc9a1405

                Download Submit

              • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
                Filesize

                242B

                MD5

                f9d0316f90be5ca9abbd02967b30d2c0

                SHA1

                b11738e8fbf8149e53b386affd4cec9fce92a35f

                SHA256

                2c32f7df585e8074415a68eb4c22bb6f8df838b076fcf94e57b6a4ffec81ee97

                SHA512

                91de3bb8c69534e865a093da84ee62e7d3c3a2c78c06508c55bb8babb686364fd9946b1618c7ec7a9138ae4020d22247e68c5de33888d5d2c23590a4987c01d9

                Download Submit

              • C:\Windows\Temp\Cab59F5.tmp
                Filesize

                29KB

                MD5

                d59a6b36c5a94916241a3ead50222b6f

                SHA1

                e274e9486d318c383bc4b9812844ba56f0cff3c6

                SHA256

                a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

                SHA512

                17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

                Download Submit

              • C:\Windows\Temp\Tar5B43.tmp
                Filesize

                181KB

                MD5

                4ea6026cf93ec6338144661bf1202cd1

                SHA1

                a1dec9044f750ad887935a01430bf49322fbdcb7

                SHA256

                8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                SHA512

                6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                Download Submit

              • \Program Files\TacticalAgent\meshagent.exe
                Filesize

                3.3MB

                MD5

                49274d5c7cd9c475e108746a6a0fea98

                SHA1

                e68a826e9e7f51c89a7fd664bf78bcc276546fe6

                SHA256

                c85f8bf714d197d985679d43dde65fa18d330d76afbeb9979a47c8045d648219

                SHA512

                94111b24577bcdac47d3e4edb525989f21ebda6238fbfe3d59e5f5f265d5922b8c233a125577f8e0a734938c470e62b7d2429a6304862c9c09f75a1df5f68aba

                Download Submit

              • \Program Files\TacticalAgent\tacticalrmm.exe
                Filesize

                9.2MB

                MD5

                bb383b7c3d5e4acb1001ab099b5b0f3c

                SHA1

                cb0c85f84a454aa4b1aab02bfba47c4355c2311e

                SHA256

                a6d3159c858aa3704f35d69b27829618ad0d1bae894c848a5233100c17464f95

                SHA512

                157dda96d1cacea55a6be27b9d432225b47d7334e664e577cef82a14c7eb1be1b8b84423b3905a4c1caecb5394be264d9b5c3e32109a4893e51a9d406ce740be

                Download Submit

              • memory/944-14-0x0000000000400000-0x0000000000712000-memory.dmp

                Filesize

                3.1MB

                Download

              • memory/944-28-0x0000000000400000-0x0000000000712000-memory.dmp

                Filesize

                3.1MB

                Download

              • memory/1212-32-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/1212-145-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/1212-33-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/1212-70-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/1212-124-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/1212-125-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/1212-126-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/1212-127-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/1212-128-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/1212-130-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/1212-129-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/1212-71-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/1212-74-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/1212-75-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/1212-144-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/1732-121-0x0000000001D10000-0x0000000001D18000-memory.dmp

                Filesize

                32KB

                Download

              • memory/1732-120-0x000000001B2B0000-0x000000001B592000-memory.dmp

                Filesize

                2.9MB

                Download

              • memory/1996-24-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/1996-25-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/2560-4-0x0000000000400000-0x00000000004D7000-memory.dmp

                Filesize

                860KB

                Download

              • memory/2560-7-0x0000000000401000-0x00000000004B7000-memory.dmp

                Filesize

                728KB

                Download

              • memory/2560-29-0x0000000000400000-0x00000000004D7000-memory.dmp

                Filesize

                860KB

                Download

              • memory/2924-112-0x00000000024C0000-0x00000000024C8000-memory.dmp

                Filesize

                32KB

                Download

              • memory/2924-111-0x000000001B290000-0x000000001B572000-memory.dmp

                Filesize

                2.9MB

                Download

              • memory/2940-287-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/2940-289-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/2940-288-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/2940-284-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/2940-419-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/2940-141-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download

              • memory/2940-142-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

                Download