Overview

overview

10

Static

static

3

file.exe

windows10-2004-x64

10

file.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    95s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    28/05/2026, 02:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    file.exe
  • Size 5.8MB
  • Sample260528-cls8msfs7w
  • SHA256 9098906159e0e4c845eb918886fadc2723f2a321281b8003e471f09140321f91
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoorazure-opsdiscoveryexecutionmeshagentpersistencerattrojan

Malware Config

Extracted

Family

  • meshagent

Version

  • 2

Botnet

  • azure-ops

C2

  • http://azurenetfiles.net:443/agent.ashx

Attributes
  • mesh_id

    0xF58ECCF42B32B5E146C5264F372501FB6EC415BCDFD304BEAFC6EC5BBEEE39B3DA5888A08361221067E9A1817F5BC05B

  • server_id

    9E67C900E74E2DD239C1298A24D7ECDC3A20EB966E4C441D0108D581D870DC1A9DA4C4E27449938D4D798CF025BCB7ED

  • wss

    wss://azurenetfiles.net:443/agent.ashx

Signatures

  • Family: MeshAgent

    MeshAgent is an open source remote access trojan written in C++.

    rattrojanbackdoormeshagent
  • Detects MeshAgent payload 1 IoCs
  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Executes dropped EXE 5 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Modifies data under HKEY_USERS 48 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2460
    • C:\Windows\system32\net.exe
      net session
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5684
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 session
        3⤵
          PID:3668
      • C:\Users\Admin\AppData\Local\Temp\mc_ca24a2b11120a4c2.exe
        C:\Users\Admin\AppData\Local\Temp\mc_ca24a2b11120a4c2.exe -fulluninstall
        2⤵
        • Executes dropped EXE
        PID:5188
      • C:\Users\Admin\AppData\Local\Temp\mc_ca24a2b11120a4c2.exe
        C:\Users\Admin\AppData\Local\Temp\mc_ca24a2b11120a4c2.exe -fullinstall
        2⤵
        • Sets service image path in registry
        • Executes dropped EXE
        • Drops file in Program Files directory
        PID:2100
      • C:\Program Files\Mesh Agent\MeshAgent.exe
        "C:\Program Files\Mesh Agent\MeshAgent.exe" -state
        2⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        PID:3408
      • C:\Windows\system32\sc.exe
        sc query "Mesh Agent"
        2⤵
        • Launches sc.exe
        PID:1676
    • C:\Program Files\Mesh Agent\MeshAgent.exe
      "C:\Program Files\Mesh Agent\MeshAgent.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Modifies data under HKEY_USERS
      • Suspicious use of WriteProcessMemory
      PID:1444
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -noprofile -nologo -command -
        2⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:6084
      • C:\Program Files\Mesh Agent\MeshAgent.exe
        MeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=
        2⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        PID:5720
      • C:\Windows\system32\cmd.exe
        /c manage-bde -protectors -get C: -Type recoverypassword
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:5264
        • C:\Windows\system32\manage-bde.exe
          manage-bde -protectors -get C: -Type recoverypassword
          3⤵
            PID:2144

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            MeshAgent.db
            • Path C:\Program Files\Mesh Agent\MeshAgent.db
            • Size 39KB
            • SHA256 5193810dfeec659568d39853c74f6750e9b7bc6001f2a6e81b0928d3fb8bbf7f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MeshAgent.db
            • Path C:\Program Files\Mesh Agent\MeshAgent.db
            • Size 168KB
            • SHA256 cc1c40bf50fff72a0673d4912ed0ab23dce5984575f86903f72982ed91e016d7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mc_ca24a2b11120a4c2.exe
            • Path C:\Users\Admin\AppData\Local\Temp\mc_ca24a2b11120a4c2.exe
            • Size 3.3MB
            • SHA256 d83fdb9e53c5ff03c4cb0451ea1bebd79b53f29eadc1e2fa394c7af13a86ce2f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DB2E2A3383ABE03AE7217AF72AE0AE8CF6BC7343
            • Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\DB2E2A3383ABE03AE7217AF72AE0AE8CF6BC7343
            • Size 1KB
            • SHA256 0d1f20ec6eda0aeafda932298d9e61cf40a69a56ee49faa4e499d2df8640f63f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __PSScriptPolicyTest_r4q0ec2u.a3l.ps1
            • Path C:\Windows\Temp\__PSScriptPolicyTest_r4q0ec2u.a3l.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/6084-30-0x0000020D6D100000-0x0000020D6D122000-memory.dmp
            Download

            memory/6084-32-0x0000020D6D550000-0x0000020D6D596000-memory.dmp
            Download