meshagent | 015875698c176bb337f0d98742589bd6bc3d9feb1e220f45c4066c982aae6147N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
015875698c176bb337f0d98742589bd6bc3d9feb1e220f45c4066c982aae6147N.exe
Size 3.5MB
Sample241231-dycl4avnas
SHA256 015875698c176bb337f0d98742589bd6bc3d9feb1e220f45c4066c982aae6147
MD5 dbe13f391e863ab0a4138a4f22ea9270
SHA1 8ae46ac867055bcb1b402cda21e6bff476192c80
SHA512 c1589155c4140c083dd073a55be5642ceec3e0710fe107af922fbaac48a20bd1ecf6a27803b60c62fc51c5c2d4fd337c5746df979f1d8075a3ba30f1eef5c269
SSDEEP 49152:pkyWjz2nxArwHfMj0svXNGr8VCencjWNAJtSaGUUHRh2SZ0xdHuH52M8:p5Wjzbb9vXNzVagIUxh2mQM8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

meshagent

Malware Config

Signatures

Detects MeshAgent payload 1 IoCs

resource	yara_rule
sample	family_meshagent

Meshagent family
meshagent

File Explorer

015875698c176bb337f0d98742589bd6bc3d9feb1e220f45c4066c982aae6147N.exe

.exe 3.5MB

015875698c176bb337f0d98742589bd6bc3d9feb1e220f45c4066c982aae6147N.exe

IMPHASH 5f135af9145823b17cb780fc33797a43
SHA256 015875698c176bb337f0d98742589bd6bc3d9feb1e220f45c4066c982aae6147
MD5 dbe13f391e863ab0a4138a4f22ea9270
SHA1 8ae46ac867055bcb1b402cda21e6bff476192c80
SHA512 c1589155c4140c083dd073a55be5642ceec3e0710fe107af922fbaac48a20bd1ecf6a27803b60c62fc51c5c2d4fd337c5746df979f1d8075a3ba30f1eef5c269
SSDEEP 49152:pkyWjz2nxArwHfMj0svXNGr8VCencjWNAJtSaGUUHRh2SZ0xdHuH52M8:p5Wjzbb9vXNzVagIUxh2mQM8
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Detects MeshAgent payload

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

1806416

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\MeshAgent\MeshAgent\Release\MeshService.pdb

crypt32

CertEnumCertificatesInStore CertDuplicateCertificateContext CertStrToNameW CertOpenStore CryptMsgCalculateEncodedLength CertFindCertificateInStore CertSetCertificateContextProperty CryptEncodeObject CryptMsgGetParam CertStrToNameA CertCloseStore CryptSignAndEncodeCertificate PFXExportCertStore CryptMsgControl CryptMsgOpenToDecode CertAddCertificateContextToStore CryptMsgOpenToEncode CertFreeCertificateContext CertCreateSelfSignCertificate CryptExportPublicKeyInfo CryptMsgUpdate CryptMsgClose CertAddEncodedCertificateToStore CryptAcquireCertificatePrivateKey CertDeleteCertificateFromStore CertGetCertificateContextProperty

ncrypt

NCryptCreatePersistedKey BCryptGetProperty BCryptOpenAlgorithmProvider NCryptOpenStorageProvider BCryptCreateHash NCryptSetProperty BCryptHashData NCryptFreeObject NCryptFinalizeKey BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptGenRandom

dbghelp

SymInitialize SymFromAddr MiniDumpWriteDump SymGetModuleBase64 SymGetLineFromAddr64 SymFunctionTableAccess64 StackWalk64

iphlpapi

GetAdaptersAddresses SendARP ConvertLengthToIpv4Mask GetAdaptersInfo

ws2_32

__WSAFDIsSet htons htonl gethostname ntohs ntohl WSAGetLastError ioctlsocket recv send gethostbyname getaddrinfo freeaddrinfo getnameinfo WSASetLastError getsockname WSASocketW listen closesocket bind accept WSACleanup FreeAddrInfoW select WSACloseEvent WSACreateEvent WSAStartup WSAEventSelect WSAResetEvent GetAddrInfoW WSAIoctl shutdown connect recvfrom getsockopt sendto socket setsockopt

gdiplus

GdipCloneImage GdiplusStartup GdiplusShutdown GdipDisposeImage GdipLoadImageFromStreamICM GdipFree GdipGetImageEncodersSize GdipSaveImageToStream GdipLoadImageFromStream GdipGetImageEncoders GdipAlloc

kernel32

InterlockedPushEntrySList InterlockedFlushSList RtlUnwind EnterCriticalSection GetFullPathNameW GetStdHandle WriteFile LoadLibraryExA GetModuleFileNameW GetSystemPowerStatus OpenProcess MultiByteToWideChar Sleep GetLastError CloseHandle GetCurrentDirectoryW SetCurrentDirectoryW GetProcAddress SetEnvironmentVariableA CreateProcessW FreeLibrary WideCharToMultiByte WaitForSingleObject GetCurrentThreadId GetModuleHandleA CreateThread QueueUserAPC OpenThread ReadFile LoadLibraryA SleepEx SetSystemPowerState GetCurrentProcess SetThreadExecutionState HeapFree HeapAlloc GetProcessHeap SystemTimeToFileTime GetSystemTime FileTimeToSystemTime QueryPerformanceFrequency LeaveCriticalSection QueryPerformanceCounter ReleaseSemaphore CreateSemaphoreA CancelIo FindFirstFileW FindNextFileW RemoveDirectoryW GetFinalPathNameByHandleW GetDriveTypeA SetFilePointer FindFirstVolumeA FindClose CreateFileW GetVolumePathNamesForVolumeNameA GetFileAttributesExW ReadDirectoryChangesW FindNextVolumeA FindVolumeClose GetDiskFreeSpaceExA CreateEventA GetModuleHandleExA WaitForMultipleObjectsEx CreateNamedPipeA DisconnectNamedPipe CreateFileA CancelIoEx LocalFree ConnectNamedPipe SetConsoleOutputCP IsDebuggerPresent TerminateProcess GetStartupInfoW CancelSynchronousIo SetEvent WaitForSingleObjectEx ResetEvent GetThreadId GetCurrentProcessId GetEnvironmentStrings FreeEnvironmentStringsA CopyFileW MoveFileW RtlCaptureContext SuspendThread ResumeThread DuplicateHandle ExitThread GetTickCount64 GetCurrentThread DeleteFileA GetOverlappedResult GetThreadContext WTSGetActiveConsoleSessionId GetExitCodeProcess SetEndOfFile DeleteFileW SetFilePointerEx SetConsoleCtrlHandler FreeConsole LoadLibraryExW SetLastError GetFileType GetModuleHandleW FormatMessageW SwitchToFiber DeleteFiber CreateFiber GetSystemTimeAsFileTime ConvertFiberToThread ConvertThreadToFiber GetEnvironmentVariableW GetConsoleMode ReadConsoleA ReadConsoleW SetConsoleMode DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW CreateProcessA HeapValidate GetSystemInfo CreateDirectoryW GetConsoleCP MoveFileExW SetEnvironmentVariableW SetCurrentDirectoryA GetCurrentDirectoryA GetTimeZoneInformation SetStdHandle GetDriveTypeW PeekNamedPipe GetModuleFileNameA GetCommandLineA GetCommandLineW GetACP RaiseException GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter GetTempPathW IsProcessorFeaturePresent GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers HeapReAlloc HeapSize HeapQueryInformation GetStringTypeW WriteConsoleW GetCPInfo GetFullPathNameA OutputDebugStringA OutputDebugStringW FindFirstFileExA FindFirstFileExW FindNextFileA IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW EncodePointer SystemTimeToTzSpecificLocalTime DecodePointer

user32

SetWindowTextW GetWindowPlacement ShowWindow SetWindowPlacement SetWindowTextA GetDlgItem DialogBoxParamW EnableWindow MessageBeep ExitWindowsEx GetUserObjectInformationA EnumDisplayMonitors GetSystemMetrics SetThreadDesktop GetThreadDesktop CloseDesktop BlockInput GetMonitorInfoA OpenInputDesktop GetKeyState GetMessageA GetMessageExtraInfo DispatchMessageA GetWindowRect EndDialog GetDC PostMessageA GetIconInfo CallNextHookEx GetCursorInfo SetWindowsHookExA MapVirtualKeyA GetForegroundWindow UnhookWindowsHookEx DefWindowProcA CreateWindowExA TranslateMessage UnregisterClassA DrawIconEx SetWinEventHook RegisterClassExA UnhookWinEvent SetForegroundWindow ReleaseDC SendInput SetProcessDPIAware GetProcessWindowStation GetUserObjectInformationW DestroyWindow SendMessageW MessageBoxW LoadCursorA

gdi32

GetStockObject SetTextColor SetBkMode CreateSolidBrush BitBlt StretchBlt DeleteDC SetStretchBltMode SelectObject CreateCompatibleBitmap GetObjectA DeleteObject GetDIBits CreateCompatibleDC

advapi32

RegCloseKey DeregisterEventSource StartServiceCtrlDispatcherA QueryServiceStatus CloseServiceHandle AllocateAndInitializeSid SetServiceStatus OpenSCManagerA RegisterServiceCtrlHandlerExA FreeSid CheckTokenMembership OpenServiceA SetTokenInformation CreateProcessAsUserW DuplicateTokenEx SetSecurityDescriptorDacl SetEntriesInAclA InitializeSecurityDescriptor CryptDestroyKey RegSetValueExW RegOpenKeyExW RegQueryValueExW CryptReleaseContext AdjustTokenPrivileges LookupPrivilegeValueA InitiateSystemShutdownA CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptAcquireContextW ReportEventW RegDeleteValueA RegCreateKeyW RegOpenKeyExA RegSetValueExA RegQueryValueExA RegDeleteKeyA OpenProcessToken RegisterEventSourceW

shell32

ShellExecuteExW

ole32

CoCreateInstance CreateStreamOnHGlobal CoInitializeEx CoUninitialize

oleaut32

SysAllocString SysFreeString SysStringLen