Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/10/2026, 05:59
Static task
static1
Behavioral task
behavioral1
Sample
README.html
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
README.html
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
UEMSAgent.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral4
Sample
UEMSAgent.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral5
Sample
setup.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
setup.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target UEMSAgent.msi
- Size 59.2MB
- Sample261020-gpvcbsdw31
- SHA256 c9ed8526107dee9b2b81258401fd4a64916440766be3bfb733af77ca589455c5
- MD5 c15194355c0d5e7dcf59eee23ea58242
- SHA1 ee1d3ed343fb7d3feb80d3378f296d9850ad4611
- SHA512 4d4336690c60f6df940a55476a3678255da896b70bc308829088405ec5ab41905abbae4567c5444dfa5dd3e34b3615d32aea1e206aac0544473881e649053e83
- SSDEEP 1572864:P4MOow7RkqNQrLqXQ3yVbVxkODIwXxe8FBAJzKadGZn8B0Sz:wBBRMsQ3y1V4gxeBhKad8nSTz
- TLSH T1F2D7333270898031EA07507D497F9F7D897E6E600BBD94FBA3D8BC1A4671BD287305A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- DCAgent remote management tool 1 IoCs
DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor
resource yara_rule behavioral3/files/0x0007000000024511-15.dat hacktool_dcagent - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 6 1456 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log MsiExec.exe - Loads dropped DLL 1 IoCs
pid Process 6020 MsiExec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1456 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1456 msiexec.exe Token: SeIncreaseQuotaPrivilege 1456 msiexec.exe Token: SeSecurityPrivilege 5244 msiexec.exe Token: SeCreateTokenPrivilege 1456 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1456 msiexec.exe Token: SeLockMemoryPrivilege 1456 msiexec.exe Token: SeIncreaseQuotaPrivilege 1456 msiexec.exe Token: SeMachineAccountPrivilege 1456 msiexec.exe Token: SeTcbPrivilege 1456 msiexec.exe Token: SeSecurityPrivilege 1456 msiexec.exe Token: SeTakeOwnershipPrivilege 1456 msiexec.exe Token: SeLoadDriverPrivilege 1456 msiexec.exe Token: SeSystemProfilePrivilege 1456 msiexec.exe Token: SeSystemtimePrivilege 1456 msiexec.exe Token: SeProfSingleProcessPrivilege 1456 msiexec.exe Token: SeIncBasePriorityPrivilege 1456 msiexec.exe Token: SeCreatePagefilePrivilege 1456 msiexec.exe Token: SeCreatePermanentPrivilege 1456 msiexec.exe Token: SeBackupPrivilege 1456 msiexec.exe Token: SeRestorePrivilege 1456 msiexec.exe Token: SeShutdownPrivilege 1456 msiexec.exe Token: SeDebugPrivilege 1456 msiexec.exe Token: SeAuditPrivilege 1456 msiexec.exe Token: SeSystemEnvironmentPrivilege 1456 msiexec.exe Token: SeChangeNotifyPrivilege 1456 msiexec.exe Token: SeRemoteShutdownPrivilege 1456 msiexec.exe Token: SeUndockPrivilege 1456 msiexec.exe Token: SeSyncAgentPrivilege 1456 msiexec.exe Token: SeEnableDelegationPrivilege 1456 msiexec.exe Token: SeManageVolumePrivilege 1456 msiexec.exe Token: SeImpersonatePrivilege 1456 msiexec.exe Token: SeCreateGlobalPrivilege 1456 msiexec.exe Token: SeCreateTokenPrivilege 1456 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1456 msiexec.exe Token: SeLockMemoryPrivilege 1456 msiexec.exe Token: SeIncreaseQuotaPrivilege 1456 msiexec.exe Token: SeMachineAccountPrivilege 1456 msiexec.exe Token: SeTcbPrivilege 1456 msiexec.exe Token: SeSecurityPrivilege 1456 msiexec.exe Token: SeTakeOwnershipPrivilege 1456 msiexec.exe Token: SeLoadDriverPrivilege 1456 msiexec.exe Token: SeSystemProfilePrivilege 1456 msiexec.exe Token: SeSystemtimePrivilege 1456 msiexec.exe Token: SeProfSingleProcessPrivilege 1456 msiexec.exe Token: SeIncBasePriorityPrivilege 1456 msiexec.exe Token: SeCreatePagefilePrivilege 1456 msiexec.exe Token: SeCreatePermanentPrivilege 1456 msiexec.exe Token: SeBackupPrivilege 1456 msiexec.exe Token: SeRestorePrivilege 1456 msiexec.exe Token: SeShutdownPrivilege 1456 msiexec.exe Token: SeDebugPrivilege 1456 msiexec.exe Token: SeAuditPrivilege 1456 msiexec.exe Token: SeSystemEnvironmentPrivilege 1456 msiexec.exe Token: SeChangeNotifyPrivilege 1456 msiexec.exe Token: SeRemoteShutdownPrivilege 1456 msiexec.exe Token: SeUndockPrivilege 1456 msiexec.exe Token: SeSyncAgentPrivilege 1456 msiexec.exe Token: SeEnableDelegationPrivilege 1456 msiexec.exe Token: SeManageVolumePrivilege 1456 msiexec.exe Token: SeImpersonatePrivilege 1456 msiexec.exe Token: SeCreateGlobalPrivilege 1456 msiexec.exe Token: SeCreateTokenPrivilege 1456 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1456 msiexec.exe Token: SeLockMemoryPrivilege 1456 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1456 msiexec.exe 1456 msiexec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5244 wrote to memory of 6020 5244 msiexec.exe 86
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\UEMSAgent.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1456
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5244 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 66D99BC7E65B7C1E954B6E63F1372D7B C2⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:6020
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
- Size 1KB
- SHA256 b66b4ba60a05384195dc34745285ba7331a3a798f6eeea2560a0f136656a78d7
- MD5 f668e68e985c578fc7b0238a9511e63b
- SHA1 c63742405137a2095d054ba2952ad8c1e1ad424a
- SHA512 fc08ed25373d4912984542cd89468e81932090e6828db7c040c8fb859da02013942d9813dd09cbcbde4419f62b6e49e73154cdd47b82f93af50dc8efc1ab4eb9
- TLSH T15721C6BB5FAD7982DF3B4D8421CBB1221DF5B1805DCD58A56225C8AC5F083F11F5990D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
- Size 1KB
- SHA256 8f41037703fd1287516b7cc19dc6d1ed3d2f930c92452303bfea5fc9a01b3cab
- MD5 d6525b17da80559965baac609087f028
- SHA1 c936adc92e663d107a721f2315654550a06ddf3b
- SHA512 dce911caee9e7ddf81c75b83a201f88341e4bdb0161501cc73005b52bf6dd96a3ab4ccf53909447c1f5e3300b412d09700631f28776bd4502da627e9b0d63b51
- TLSH T14F311D66DA7836434E50E8E41DD6B2376C94B6D068C63800B766481720803B33F45E8E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_7B944868459E0B8AA3F81222C6396988
- Size 1KB
- SHA256 f8b59befd0a67b5abbe6822b88839ac39f49cd9f8eaf535b943e284f58b3a666
- MD5 f35699c6951420c42c6bd2bfb85817d5
- SHA1 31807fe9037893a38a68c82aaa5bf953f9a2bed8
- SHA512 5be6a288e4467df5590c4da3a12cfab5345638804dc2d550bc3199c2963a64fc7f8eacf7befd99ae06fde174257de2804627ca7e11e0e662d1785deae1c32167
- TLSH T1C831FA2F4EBA7106B349C8110DE6EEB368F42AE4C1FC5775359756CA38543E24E02418
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
- Size 1KB
- SHA256 6a9ed0f02c3dda3c1e3535db327432a72205e041b55da10bfa64850cc00302e3
- MD5 7b73f4d91f25dfa40f6adaa4156970b7
- SHA1 8bd0ffe4a4646b96e58c9dc54d13e1639df767ba
- SHA512 31a4f30883c96b331eaa1e6fc5b324b6138306e6b9e595653f8f5813a7a1772d1f9c122fd83c9ad982122c663b240cf2754c9934ed9d4a118ef162002b95226f
- TLSH T1B521948346A72523EF61CD4919E46E332CF8E2E0A5C9601BF10F82E909043E7A96916A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
- Size 508B
- SHA256 ece2e80afe18d61aa171ef8828de6fa6a740894e31c5a1c63007cd33d6a842ce
- MD5 aa78381788162b8b4bdfeec4aed26656
- SHA1 fb70418afae5482f700dfe3a1b8a422941232800
- SHA512 b0b787a8aa2d8ee9bbb92943a7214f48ed48f9ecf5833d807e034329d7210d0235717959961e53cc4280fdfbaf3861fb7e868365488733e6b063185c2060bfe0
- TLSH T1CFF0271858BD113BF0B3CB7D0AD83D668A76FA161456016626E1CB4C7906F8A3C115BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
- Size 532B
- SHA256 5cfa4b2a5bed92189597c38975f62c93c72a93dffa22d37044d2ea01165838ed
- MD5 c4d8d17316f4a7c9144ba5ee73ed6009
- SHA1 026b56659620dd23a5f9b0693ae1511e590d1e54
- SHA512 4a7f90fb2763569e6c082508b07e51aa5ddce1c4d83483a33559d7a19f1bab9e923544ca141f2bbc01bf13c75febb88d0191d3ccbd48fb1ae97feffad9c83cdf
- TLSH T19BF0DC0812F9802EF476DF3D0AC8A652F965E9133C06DAA403860B0C8D24E909CA243D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_7B944868459E0B8AA3F81222C6396988
- Size 544B
- SHA256 6cc2b87e0ddf08b8db7bc976a4e16b1779fae9ba19c308cc6959bc734bce350d
- MD5 b4dff51ad66ed5c31fd51a3865e5c8ed
- SHA1 a1f80b7f30daae8f5b127645f3e8f9c65efebdd9
- SHA512 911a24990b9aa7eaebe759cbe1477c883e99ad097ef8b8f3accd9da9ac3c6f4b154ee73561dc810dac944eef099289bbf8760292529062391a2742c7ac4c517e
- TLSH T100F0971C19F6222EF276C97893D0A4620972F84B2C468EB91AD1D30C7617E49BC66E72
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
- Size 508B
- SHA256 fd8d51e05bfa0a5c06c3554a7693bbad9a54e9f1e2545708854a8f932209a96b
- MD5 da49c4d0e47dc348c8dca0d16d754db4
- SHA1 132914ea490b4266c4411e6bacdf753693d1d23c
- SHA512 ea88540755f2bb5b256c6abd2b0d43a8eaae96696da1b3f8a8117474f2a51bf42d6afbbef6d1ea1744e9dac5b8c600a5a9ce2d1df5f4519faf11bfa35168844b
- TLSH T1F4F0D42028F8900EF573DF3845D136F97A5EB503381406FD0ED546082F24F815C56136
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSID3C6.tmp
- Size 429KB
- SHA256 f78db8103f85debda13f93feafdb903823f8751640885492c6aeef938d7b09a6
- MD5 6a6ead9b264363f887b5bfc0a61b2d64
- SHA1 6cf6b43b3b2f1ad888612aa9c8bf6de9770c2c81
- SHA512 53d351045fa87fa913bec53606a142a53caa37edfecfc010780fb97f9120a9c26f6f5c890a666fb6a0fd5efdf7657c8c608d4c793cb1161c940ea23e70be84f3
- SSDEEP 12288:kpqSpvhUEaxBOJBesypR2wd/8Vyup7NTN:kJhUZxBOWsc1yFNh
- TLSH T15C94BF1135C9C031E1AE5170ADB5AF76AE7DBD200F2858CBD3C84D3B1A645C2AB76F1A
- MD5 SHA1 SHA512 SSDEEP TLSH