Analysis
- max time kernel
150s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/10/2026, 05:59
Static task
static1
Behavioral task
behavioral1
Sample
README.html
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
README.html
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
UEMSAgent.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral4
Sample
UEMSAgent.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral5
Sample
setup.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
setup.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target UEMSAgent.msi
- Size 59.2MB
- Sample261020-gpvcbsdw31
- SHA256 c9ed8526107dee9b2b81258401fd4a64916440766be3bfb733af77ca589455c5
- MD5 c15194355c0d5e7dcf59eee23ea58242
- SHA1 ee1d3ed343fb7d3feb80d3378f296d9850ad4611
- SHA512 4d4336690c60f6df940a55476a3678255da896b70bc308829088405ec5ab41905abbae4567c5444dfa5dd3e34b3615d32aea1e206aac0544473881e649053e83
- SSDEEP 1572864:P4MOow7RkqNQrLqXQ3yVbVxkODIwXxe8FBAJzKadGZn8B0Sz:wBBRMsQ3y1V4gxeBhKad8nSTz
- TLSH T1F2D7333270898031EA07507D497F9F7D897E6E600BBD94FBA3D8BC1A4671BD287305A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- DCAgent remote management tool 1 IoCs
DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor
resource yara_rule behavioral4/files/0x000e00000001c490-2.dat hacktool_dcagent - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\ManageEngine\UEMS_Agent\logs\dcagentinstaller.log MsiExec.exe - Loads dropped DLL 1 IoCs
pid Process 5900 MsiExec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 616 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 616 msiexec.exe Token: SeIncreaseQuotaPrivilege 616 msiexec.exe Token: SeSecurityPrivilege 1536 msiexec.exe Token: SeCreateTokenPrivilege 616 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 616 msiexec.exe Token: SeLockMemoryPrivilege 616 msiexec.exe Token: SeIncreaseQuotaPrivilege 616 msiexec.exe Token: SeMachineAccountPrivilege 616 msiexec.exe Token: SeTcbPrivilege 616 msiexec.exe Token: SeSecurityPrivilege 616 msiexec.exe Token: SeTakeOwnershipPrivilege 616 msiexec.exe Token: SeLoadDriverPrivilege 616 msiexec.exe Token: SeSystemProfilePrivilege 616 msiexec.exe Token: SeSystemtimePrivilege 616 msiexec.exe Token: SeProfSingleProcessPrivilege 616 msiexec.exe Token: SeIncBasePriorityPrivilege 616 msiexec.exe Token: SeCreatePagefilePrivilege 616 msiexec.exe Token: SeCreatePermanentPrivilege 616 msiexec.exe Token: SeBackupPrivilege 616 msiexec.exe Token: SeRestorePrivilege 616 msiexec.exe Token: SeShutdownPrivilege 616 msiexec.exe Token: SeDebugPrivilege 616 msiexec.exe Token: SeAuditPrivilege 616 msiexec.exe Token: SeSystemEnvironmentPrivilege 616 msiexec.exe Token: SeChangeNotifyPrivilege 616 msiexec.exe Token: SeRemoteShutdownPrivilege 616 msiexec.exe Token: SeUndockPrivilege 616 msiexec.exe Token: SeSyncAgentPrivilege 616 msiexec.exe Token: SeEnableDelegationPrivilege 616 msiexec.exe Token: SeManageVolumePrivilege 616 msiexec.exe Token: SeImpersonatePrivilege 616 msiexec.exe Token: SeCreateGlobalPrivilege 616 msiexec.exe Token: SeCreateTokenPrivilege 616 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 616 msiexec.exe Token: SeLockMemoryPrivilege 616 msiexec.exe Token: SeIncreaseQuotaPrivilege 616 msiexec.exe Token: SeMachineAccountPrivilege 616 msiexec.exe Token: SeTcbPrivilege 616 msiexec.exe Token: SeSecurityPrivilege 616 msiexec.exe Token: SeTakeOwnershipPrivilege 616 msiexec.exe Token: SeLoadDriverPrivilege 616 msiexec.exe Token: SeSystemProfilePrivilege 616 msiexec.exe Token: SeSystemtimePrivilege 616 msiexec.exe Token: SeProfSingleProcessPrivilege 616 msiexec.exe Token: SeIncBasePriorityPrivilege 616 msiexec.exe Token: SeCreatePagefilePrivilege 616 msiexec.exe Token: SeCreatePermanentPrivilege 616 msiexec.exe Token: SeBackupPrivilege 616 msiexec.exe Token: SeRestorePrivilege 616 msiexec.exe Token: SeShutdownPrivilege 616 msiexec.exe Token: SeDebugPrivilege 616 msiexec.exe Token: SeAuditPrivilege 616 msiexec.exe Token: SeSystemEnvironmentPrivilege 616 msiexec.exe Token: SeChangeNotifyPrivilege 616 msiexec.exe Token: SeRemoteShutdownPrivilege 616 msiexec.exe Token: SeUndockPrivilege 616 msiexec.exe Token: SeSyncAgentPrivilege 616 msiexec.exe Token: SeEnableDelegationPrivilege 616 msiexec.exe Token: SeManageVolumePrivilege 616 msiexec.exe Token: SeImpersonatePrivilege 616 msiexec.exe Token: SeCreateGlobalPrivilege 616 msiexec.exe Token: SeCreateTokenPrivilege 616 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 616 msiexec.exe Token: SeLockMemoryPrivilege 616 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 616 msiexec.exe 616 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 616 msiexec.exe 1536 msiexec.exe 5900 MsiExec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1536 wrote to memory of 5900 1536 msiexec.exe 90
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\UEMSAgent.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:616
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2D1D6795938B08D41A5D13BF83AE095C C2⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5900
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSI8A83.tmp
- Size 429KB
- SHA256 f78db8103f85debda13f93feafdb903823f8751640885492c6aeef938d7b09a6
- MD5 6a6ead9b264363f887b5bfc0a61b2d64
- SHA1 6cf6b43b3b2f1ad888612aa9c8bf6de9770c2c81
- SHA512 53d351045fa87fa913bec53606a142a53caa37edfecfc010780fb97f9120a9c26f6f5c890a666fb6a0fd5efdf7657c8c608d4c793cb1161c940ea23e70be84f3
- SSDEEP 12288:kpqSpvhUEaxBOJBesypR2wd/8Vyup7NTN:kJhUZxBOWsc1yFNh
- TLSH T15C94BF1135C9C031E1AE5170ADB5AF76AE7DBD200F2858CBD3C84D3B1A645C2AB76F1A
- MD5 SHA1 SHA512 SSDEEP TLSH