agenda | e00bac61811705d283472b77b602624c378c7e80c32e3448b06ea6a55d466c69

Resubmissions

10-02-2025 19:01

250210-xn8fkasjar 10

29-01-2025 12:50

250129-p242aswpgp 10

Analysis

max time kernel
69s
max time network
150s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
10-02-2025 19:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e00bac61811705d283472b77b602624c378c7e80c32e3448b06ea6a55d466c69.exe
Size

5.0MB
MD5

fdc6848dad660414bed9ad1b381cf6e3
SHA1

a15b95b7df68bb087427168e07c17f7b17379d56
SHA256

e00bac61811705d283472b77b602624c378c7e80c32e3448b06ea6a55d466c69
SHA512

f8b19524cd8a5bc3be92ed56fbd92494bf29e8c632d763bc26bfad284ee99b34cfd55e683849dc900952448a14a92d78c8754374172b66319cd9086fb50f5312
SSDEEP

98304:qJGs5VU36W6YYsL2xYvoiptNrCXTUDqCiPymLyt4U:qLih6YYsayvoiptNOXTUhmLyB

Score

10^/10

agenda discovery ransomware

Malware Config

Extracted

Family

agenda

Attributes

company_id
BnpNJ1AIYp
note
-- Qilin Your network/system was encrypted. Encrypted files have new extension. -- Compromising and sensitive data We have downloaded compromising and sensitive data from your system/network. Our group cooperates with the mass media. If you refuse to communicate with us and we do not come to an agreement, your data will be reviewed and published on our blog and on the media page (https://31.41.244.100) Blog links: http://kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion Data includes: - Employees personal data, CVs, DL , SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... -- Warning 1) If you modify files - our decrypt software won't able to recover data 2) If you use third party software - you can damage/modify files (see item 1) 3) You need cipher key / our decrypt software to restore you files. 4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Go to domain 3) Enter credentials Please note that communication with us is only possible via the website in the Tor browser, which is specified in this note. All other means of communication are not real and may be created by third parties, if such were not provided in this note or on the website specified in this note. -- Credentials Extension: BnpNJ1AIYp Domain: x3n3litmjegzhaxaeoq5pzkfb4qmx6ky3wlisa3felyhnnbbm4agbjad.onion login: acHiM35O6y_NmAE6q7TJS2tdydFFCybT password:

rsa_pubkey.plain

Signatures

Agenda Ransomware
A ransomware with multiple variants written in Golang and Rust first seen in August 2022.
ransomware agenda
Agenda family
agenda
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e00bac61811705d283472b77b602624c378c7e80c32e3448b06ea6a55d466c69.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1076	chrome.exe
1076	chrome.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 2672	1076	chrome.exe	32
PID 1076 wrote to memory of 2672	1076	chrome.exe	32
PID 1076 wrote to memory of 2672	1076	chrome.exe	32
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 1888	1076	chrome.exe	34
PID 1076 wrote to memory of 2544	1076	chrome.exe	35
PID 1076 wrote to memory of 2544	1076	chrome.exe	35
PID 1076 wrote to memory of 2544	1076	chrome.exe	35
PID 1076 wrote to memory of 2588	1076	chrome.exe	36
PID 1076 wrote to memory of 2588	1076	chrome.exe	36
PID 1076 wrote to memory of 2588	1076	chrome.exe	36
PID 1076 wrote to memory of 2588	1076	chrome.exe	36
PID 1076 wrote to memory of 2588	1076	chrome.exe	36
PID 1076 wrote to memory of 2588	1076	chrome.exe	36
PID 1076 wrote to memory of 2588	1076	chrome.exe	36
PID 1076 wrote to memory of 2588	1076	chrome.exe	36
PID 1076 wrote to memory of 2588	1076	chrome.exe	36
PID 1076 wrote to memory of 2588	1076	chrome.exe	36
PID 1076 wrote to memory of 2588	1076	chrome.exe	36
PID 1076 wrote to memory of 2588	1076	chrome.exe	36
PID 1076 wrote to memory of 2588	1076	chrome.exe	36
PID 1076 wrote to memory of 2588	1076	chrome.exe	36
PID 1076 wrote to memory of 2588	1076	chrome.exe	36
PID 1076 wrote to memory of 2588	1076	chrome.exe	36
PID 1076 wrote to memory of 2588	1076	chrome.exe	36
PID 1076 wrote to memory of 2588	1076	chrome.exe	36
PID 1076 wrote to memory of 2588	1076	chrome.exe	36

C:\Users\Admin\AppData\Local\Temp\e00bac61811705d283472b77b602624c378c7e80c32e3448b06ea6a55d466c69.exe
"C:\Users\Admin\AppData\Local\Temp\e00bac61811705d283472b77b602624c378c7e80c32e3448b06ea6a55d466c69.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1852

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fefb389758,0x7fefb389768,0x7fefb389778
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1188 --field-trial-handle=1376,i,14636774244807523019,17306345577185997764,131072 /prefetch:2
  2⤵
  PID:1888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1520 --field-trial-handle=1376,i,14636774244807523019,17306345577185997764,131072 /prefetch:8
  2⤵
  PID:2544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1616 --field-trial-handle=1376,i,14636774244807523019,17306345577185997764,131072 /prefetch:8
  2⤵
  PID:2588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2288 --field-trial-handle=1376,i,14636774244807523019,17306345577185997764,131072 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2296 --field-trial-handle=1376,i,14636774244807523019,17306345577185997764,131072 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2820 --field-trial-handle=1376,i,14636774244807523019,17306345577185997764,131072 /prefetch:2
  2⤵
  PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1332 --field-trial-handle=1376,i,14636774244807523019,17306345577185997764,131072 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3424 --field-trial-handle=1376,i,14636774244807523019,17306345577185997764,131072 /prefetch:8
  2⤵
  PID:932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3544 --field-trial-handle=1376,i,14636774244807523019,17306345577185997764,131072 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3904 --field-trial-handle=1376,i,14636774244807523019,17306345577185997764,131072 /prefetch:8
  2⤵
  PID:908

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
33177485ba2607eb1af221ddd495d79a

SHA1
db872d88684d0b9998b41ae2fb0f0d7a0885822a

SHA256
bc6a13a51358a6e9d741a1a1e1255b7f21c4bdf7158be2ef322d0367c9355117

SHA512
769b648c22d88763cfd7821ae33678591ca440146ff25455bf7833f1a568a01b520f6b58f41e73e34bdc8b085834a574175b57211a00d4948f5c5cdc361beec3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
9838e232876a2e121f5090354d722b2a

SHA1
39fcbcc4b8681da2d3eee031b33a4e270f53a0f7

SHA256
b73ea56984832e563d6a2cc1f85c77b74d4361a015aef13e936c0d7190615547

SHA512
33896f96a0065c67e3a3627e83170f28dc3184225e84af116f2fb63690d4016d5cfe67ad2726d891df36d9c548f5c46836047a89a9e06b0ac43f3e1bfa83cb11

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
memory/1852-0-0x0000000010000000-0x00000000104B5000-memory.dmp

Filesize
4.7MB

Download
memory/1852-10-0x0000000000E10000-0x0000000001319000-memory.dmp

Filesize
5.0MB

Download