agent[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
agent.exe
Size 464KB
Sample260619-p77dlsf13m
SHA256 5f0e9b54035373fc62a3a2baf2348c49f69651db8b0946832a6c9e615e2f451e
MD5 f9ba4f9f2ae56807150101ce87669ed3
SHA1 73d9412405ed8e41cf457a0f5a942e267f6b3fd4
SHA512 9616626c41d4a3b5f8e89d5818360bd7670081c6fcc0a43d25fc0c8d0364acc9e5ff2a1fad7bf2a0abf5e67bd191d7c8239fdb68f8afc475f39aabee0553187f
SSDEEP 12288:VOGbsW5YyOEZPgY4f/95XXXXXXXXWMc6U:VTbL/Np7i/9MMc6U
TLSH
T142A46B65A66800FDE1A3C5B8CE574903E672780A0330ABDF43D4AA771F27AD55E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
agent.exe

File Explorer

agent.exe

.exe 464KB

agent.exe

IMPHASH 88faeeca36637143189711b7e4db23b6
SHA256 5f0e9b54035373fc62a3a2baf2348c49f69651db8b0946832a6c9e615e2f451e
MD5 f9ba4f9f2ae56807150101ce87669ed3
SHA1 73d9412405ed8e41cf457a0f5a942e267f6b3fd4
SHA512 9616626c41d4a3b5f8e89d5818360bd7670081c6fcc0a43d25fc0c8d0364acc9e5ff2a1fad7bf2a0abf5e67bd191d7c8239fdb68f8afc475f39aabee0553187f
SSDEEP 12288:VOGbsW5YyOEZPgY4f/95XXXXXXXXWMc6U:VTbL/Np7i/9MMc6U
TLSH
T142A46B65A66800FDE1A3C5B8CE574903E672780A0330ABDF43D4AA771F27AD55E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

174752

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

getaddrinfo WSACleanup WSAStartup gethostname inet_ntop freeaddrinfo

winhttp

WinHttpConnect WinHttpWebSocketCompleteUpgrade WinHttpReceiveResponse WinHttpOpen WinHttpAddRequestHeaders WinHttpQueryHeaders WinHttpSetTimeouts WinHttpWebSocketClose WinHttpSendRequest WinHttpCloseHandle WinHttpWebSocketReceive WinHttpSetOption WinHttpWebSocketSend WinHttpOpenRequest

wininet

InternetGetConnectedState

gdi32

SelectObject CreateCompatibleDC DeleteDC DeleteObject CreateCompatibleBitmap BitBlt

gdiplus

GdipSaveImageToStream GdipFree GdipDisposeImage GdipAlloc GdipCloneImage GdipGetImageEncoders GdiplusStartup GdipCreateBitmapFromScan0 GdipGetImageEncodersSize GdipCreateBitmapFromHBITMAP

mf

MFEnumDeviceSources

mfplat

MFCreateMediaType MFCreateAttributes MFStartup MFShutdown

mfreadwrite

MFCreateSourceReaderFromMediaSource

ole32

CoUninitialize CoInitializeEx CreateStreamOnHGlobal CoTaskMemFree CoCreateInstance CoCreateGuid

shell32

SHGetFolderPathA ShellExecuteA SHFileOperationA

advapi32

RegOpenKeyExA RegCreateKeyExA AdjustTokenPrivileges LookupPrivilegeValueA GetUserNameA OpenProcessToken RegCloseKey RegQueryValueExA RegSetValueExA

user32

ShowWindow GetSystemMetrics ExitWindowsEx LockWorkStation GetDC ReleaseDC

powrprof

SetSuspendState

kernel32

GetExitCodeProcess WaitForSingleObject GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CreatePipe ReadConsoleW IsValidCodePage GetACP GetOEMCP HeapReAlloc FindFirstFileExW FindNextFileW CompareStringW LoadLibraryExW HeapFree UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext HeapAlloc GetStdHandle GetModuleFileNameW IsProcessorFeaturePresent CreateProcessW DuplicateHandle GetCommandLineW GetCommandLineA GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize CreateFileW WriteConsoleW SetEndOfFile GetFileAttributesExW GetFileSizeEx RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo WriteFile Sleep GetTempPathA CreateFileA CloseHandle GetConsoleWindow GetTickCount GetComputerNameA MultiByteToWideChar GetLogicalDrives GetCurrentProcess GetDriveTypeA GetTickCount64 GetLastError GetSystemInfo GlobalMemoryStatusEx GetDiskFreeSpaceExA TerminateProcess OpenProcess CreateToolhelp32Snapshot Process32NextW K32GetProcessMemoryInfo Process32FirstW WideCharToMultiByte CreateProcessA ReadFile RtlUnwind FindFirstFileA FindNextFileA FindClose FileTimeToSystemTime CreateDirectoryA GetModuleFileNameA CreateMutexA VirtualProtect GetEnvironmentVariableA GetModuleHandleA GetCurrentThread QueryPerformanceFrequency GetThreadContext GetProcAddress GetModuleHandleW QueryPerformanceCounter IsDebuggerPresent CheckRemoteDebuggerPresent ExitProcess GetStringTypeW GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx WakeAllConditionVariable

Name

.text

Size

336KB

Virtual Size

336KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

101KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

776B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

agent.exe

ws2_32

winhttp

wininet

gdi32

gdiplus

mf

mfplat

mfreadwrite

ole32

shell32

advapi32

user32

powrprof

kernel32

generic