agent[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
agent.exe
Size 4.9MB
Sample261020-2z3rnsys5j
SHA256 3bdaf55db10e85e07642227ca10c1bc7534a9e609a1087d7beefc5d9854d7400
MD5 aec51e9526c6e3d322f89c44f5adb154
SHA1 c4d8450dd330df6ef3a4e1c3629e72e90de291e7
SHA512 56eadac92d7f806ded1a5a43c2ed05a022dc4abfb3950bc5da0215a4cfa6ef06a5d710f256a5679ae3bc7a319f72913380a16c7ef44d9edf914da1e2dc68cae1
SSDEEP 98304:8j6zP0ytvrashWaHrrS78VVmBVYeRMRH/dsTIcLurIyP:8j6oyZckK78VuVYQ6FsTzSrL
TLSH
T11236120BE29254FCC12BD03987ABA772B971B80902347E6B5B50DF723F60B50976DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
agent.exe

File Explorer

agent.exe

.exe 4.9MB

agent.exe

IMPHASH 87bf812860b45a3d8940d16d3eda311e
SHA256 3bdaf55db10e85e07642227ca10c1bc7534a9e609a1087d7beefc5d9854d7400
MD5 aec51e9526c6e3d322f89c44f5adb154
SHA1 c4d8450dd330df6ef3a4e1c3629e72e90de291e7
SHA512 56eadac92d7f806ded1a5a43c2ed05a022dc4abfb3950bc5da0215a4cfa6ef06a5d710f256a5679ae3bc7a319f72913380a16c7ef44d9edf914da1e2dc68cae1
SSDEEP 98304:8j6zP0ytvrashWaHrrS78VVmBVYeRMRH/dsTIcLurIyP:8j6oyZckK78VuVYQ6FsTzSrL
TLSH
T11236120BE29254FCC12BD03987ABA772B971B80902347E6B5B50DF723F60B50976DB25
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

GetTokenInformation GetUserNameW OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteTreeW RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDecrypt BCryptDestroyHash BCryptDestroyKey BCryptEncrypt BCryptFinishHash BCryptGenRandom BCryptGenerateSymmetricKey BCryptHashData BCryptOpenAlgorithmProvider BCryptSetProperty

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateDIBSection DeleteDC DeleteObject GetDIBits SelectObject

kernel32

AddVectoredExceptionHandler AllocConsole AttachConsole CheckRemoteDebuggerPresent CloseHandle CopyFileW CreateDirectoryW CreateEventA CreateEventW CreateFileMappingW CreateFileW CreateMutexW CreatePipe CreateProcessW CreateSemaphoreA CreateThread DeleteCriticalSection DeleteFileW DuplicateHandle EnterCriticalSection FindClose FindFirstFileW FindNextFileW FlushInstructionCache FormatMessageA FormatMessageW GetComputerNameW GetConsoleWindow GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesExW GetFileAttributesW GetFileSizeEx GetFileTime GetLastError GetLocalTime GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetNativeSystemInfo GetProcAddress GetProcessAffinityMask GetProcessHeap GetSystemDirectoryW GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadPriority GetTickCount GetTickCount64 GlobalMemoryStatusEx HeapAlloc InitializeCriticalSection IsDebuggerPresent LeaveCriticalSection LoadLibraryW LocalFree MapViewOfFile MoveFileExW MultiByteToWideChar OpenEventW OpenMutexW OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReadProcessMemory ReleaseMutex ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleOutputCP SetEvent SetFileAttributesW SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualAllocEx VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteFile WriteProcessMemory __C_specific_handler

mf

MFEnumDeviceSources

mfplat

MFCreateAttributes MFCreateMediaType MFShutdown MFStartup

mfreadwrite

MFCreateSourceReaderFromMediaSource

api-ms-win-crt-convert-l1-1-0

atoi mbrtowc mbsrtowcs strtoul wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

__intrinsic_setjmp longjmp memchr memcmp memcpy memmove strchr

api-ms-win-crt-runtime-l1-1-0

_assert __p___argc __p___argv _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthreadex _errno _exit _initialize_narrow_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsnwprintf_s __stdio_common_vsprintf _fileno _read _setmode fflush fputc fputs freopen_s fwrite setvbuf

api-ms-win-crt-string-l1-1-0

_strdup _wcsicmp memset strcmp strlen strncmp strnlen wcscmp wcslen wcsnlen

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-utility-l1-1-0

rand_s

ntdll

NtCreateSection NtMapViewOfSection NtUnmapViewOfSection

ole32

CoCreateInstance CoInitializeEx CoTaskMemFree

oleaut32

VariantInit

shell32

SHGetFolderPathW

user32

CallNextHookEx DispatchMessageW GetAsyncKeyState GetDC GetMessageW GetSystemMetrics PostThreadMessageW ReleaseDC SetWindowsHookExW TranslateMessage UnhookWindowsHookEx

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetTimeouts

ws2_32

WSACleanup WSAStartup closesocket connect getsockname htons inet_addr inet_ntop socket

Name

.text

Size

448KB

Virtual Size

448KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

768B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

61KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

agent.exe

advapi32

bcrypt

gdi32

kernel32

mf

mfplat

mfreadwrite

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

ntdll

ole32

oleaut32

shell32

user32

winhttp

ws2_32

generic