91969a5bf69ec34080cb58604b0e0e49301502512e110a1ac01ee0dba9aae5ae

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 12:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Sectigo_MS_Agent.exe
Size 669KB
Sample260604-pkbcnaev9y
SHA256 91969a5bf69ec34080cb58604b0e0e49301502512e110a1ac01ee0dba9aae5ae
MD5 b9582f5035e615c72513b5f8d0f82868
SHA1 5fa1426c5d44d0e752b20f3a5b55c79b337566fe
SHA512 de821a32f85279c14d877b443727300df729e2c0737158a177c4e10b8934445cb164388003b28feed6fa4e7252df3879f3468a0615ad2404b4b683d67051981b
SSDEEP 12288:4zNB0JfiwSdYSui8zZH94I3H1v1rJ2ACGIEmlWfaNurW8hQXwVL:ENsfiTdYSuVzZH9tH1v1reGXVgQhQgVL
TLSH
T1A5E48D315060417EE6F10DB3B9289A30FD6CD33B17509EEADAC4AF1D7DA84816BB7216
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 1 IoCs

pid	Process
4216	Sectigo_MS_Agent.exe

Loads dropped DLL 1 IoCs

pid	Process
4216	Sectigo_MS_Agent.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sectigo_MS_Agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sectigo_MS_Agent.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 4216	5024	Sectigo_MS_Agent.exe	80

C:\Users\Admin\AppData\Local\Temp\Sectigo_MS_Agent.exe
"C:\Users\Admin\AppData\Local\Temp\Sectigo_MS_Agent.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Windows\Temp\{598DF98E-7F73-4CA3-9DB8-FEF811ED4AE6}\.cr\Sectigo_MS_Agent.exe
  "C:\Windows\Temp\{598DF98E-7F73-4CA3-9DB8-FEF811ED4AE6}\.cr\Sectigo_MS_Agent.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\Sectigo_MS_Agent.exe" -burn.filehandle.attached=724 -burn.filehandle.self=728
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logo.png

Path C:\Windows\Temp\{54968B33-CDF2-4C4E-8983-93AEFB59F4DE}\.ba\logo.png
Size 17KB
SHA256 080d5308c29b8bdbaad4b0833b046774ed731e06c1a01818b1813dfe40d0646f
MD5 6345abee5076a4e7fea7e2907f61f44f
SHA1 c5ffefaf150679dfd3b1643c496a358a1f5d1fc1
SHA512 015a1c5d25ab171205265d57ac22db2de0dfd8a490ff743675115d31de8840d71bf91a0de472ca3eb8864eb123bead54766738c85990fd505eb2a6ac370f442d
SSDEEP 96:mkEWR5JlxNXJn2wIrcwzP3nB2ryPNemUux/4squDvjIblU3fupQt/FxoF+cx:mktT4B2GP5UuJJDMMupQtNSkcx
TLSH
T138721A66FDF17068A8D99A320DD934522D3323839A81EC04BBDD886A5F10FCD9D0F153
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{54968B33-CDF2-4C4E-8983-93AEFB59F4DE}\.ba\wixstdba.dll
Size 184KB
SHA256 2bea14d70943a42d344e09b7c9de5562fa7e109946e1c615dd584da30d06cc80
MD5 fe7e0bd53f52e6630473c31299a49fdd
SHA1 f706f45768bfb95f4c96dfa0be36df57aa863898
SHA512 feed48286b1e182996a3664f0facdf42aae3692d3d938ea004350c85764db7a0bea996dfddf7a77149c0d4b8b776fb544e8b1ce5e9944086a5b1ed6a8a239a3c
SSDEEP 3072:iaVVzf0r2vM357+pwnohBIiv8+2kt2GOTALPN2obXbE7PKPU9+Wxhsz7CMD:iaLzfpIsHhBIqgGOTALFdbz7f
TLSH
T15F048E1175D19079E7FB1E3C593866206A7FBA200FA0C9DE57489D6B2EB01C19F36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sectigo_MS_Agent.exe

Path C:\Windows\Temp\{598DF98E-7F73-4CA3-9DB8-FEF811ED4AE6}\.cr\Sectigo_MS_Agent.exe
Size 669KB
SHA256 91969a5bf69ec34080cb58604b0e0e49301502512e110a1ac01ee0dba9aae5ae
MD5 b9582f5035e615c72513b5f8d0f82868
SHA1 5fa1426c5d44d0e752b20f3a5b55c79b337566fe
SHA512 de821a32f85279c14d877b443727300df729e2c0737158a177c4e10b8934445cb164388003b28feed6fa4e7252df3879f3468a0615ad2404b4b683d67051981b
SSDEEP 12288:4zNB0JfiwSdYSui8zZH94I3H1v1rJ2ACGIEmlWfaNurW8hQXwVL:ENsfiTdYSuVzZH9tH1v1reGXVgQhQgVL
TLSH
T1A5E48D315060417EE6F10DB3B9289A30FD6CD33B17509EEADAC4AF1D7DA84816BB7216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads