siem-agent-windows-amd64-1.15.0.zip
- SHA256 f7e629de1e26b77f3acae91d0001a1cbadddf41dd8aef77de4d5f5f37153a06d
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
install.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
install.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
siem-agent.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
siem-agent.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
uninstall.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
uninstall.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target siem-agent-windows-amd64-1.15.0.zip
- Size 4.0MB
- Sample261104-tbdtmsdh46
- SHA256 f7e629de1e26b77f3acae91d0001a1cbadddf41dd8aef77de4d5f5f37153a06d
- MD5 5079b6622c05cd70044cd293e44e0925
- SHA1 b2255fcda5f3f5e30e5e7223f97064cf0f8ba558
- SHA512 7303bbd594bbbd8d1a0715026772a7a155bbb0ead68da7da7ea78991abcb7ab35b5c9551182b118a24f2d0dc177e554178086a55e543b95dff6bbeb7de491a5a
- SSDEEP 98304:xd9s+YYqhDQV2ClSTky+eGfWguAN7wm2ZgiA98CE1HXKqUFXccE15:j9NYYIQV2CJDfW7AGmYAmCiwFMV15
- TLSH T1911633212FF9EA64ECD59D18E8C8CA342B824B3FD9D1CCB51478954B111B0A7DF4792B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/siem-agent.exe
File Explorer
-
siem-agent-windows-amd64-1.15.0.zip.zip 4.0MB
-
config.yaml1KB
-
install.ps1.ps1 4KB
-
siem-agent.exe.exe 9.8MB
-
uninstall.ps1.ps1 1KB
config.yaml
- SHA256 9d75af66305e09ddbfe78a771577f01e15279438635f4c11b093a1147204afb5
- MD5 c68e668fd27be4d56e8d449e9d2942ed
- SHA1 cae6ccbd2db53776735dcbff45ffc9cd71ed90a7
- SHA512 dfe5ff6b2c988b92f1920011f4cc3b92ee354def607925435307facda2d29c2aebf13f120bd8fdd5226d64e04668b0cceb606b21dcacbe2fa7cf12d1556399c2
- TLSH T1DD415681061E5134E96A1236EF9EA3C61735E7DAF34128B03A9D5D28B31258B81126E9
- MD5 SHA1 SHA512 TLSH
install.ps1
- SHA256 347566fc71daff44bb63e1c2cb3e0bb28af63764ad0b41dd4e07e7d91eebc6d4
- MD5 b3667f798d0361867ae1e299f53c1d06
- SHA1 ddfeaee63675a20cc329c3863ff78718f52afd32
- SHA512 53e5ba7d23d16bcb55d7780837c35a3c8fc390e3d1ba2cbe1254cde4ae474121310f4bc97ccf8c272bd921c3f080f349ddc3eec09cd25f07bb34b291b0247081
- SSDEEP 96:kPgRAm6tbzcWJpWJv1fu4ub8u/ifXzCS7q/gEKceJ73UIKI:ygRAbtHcapWfGmjCS7q/gEVeJzUI
- TLSH T1DC91B825E43803A18EB0DF98ECA4688C7D1F00570A653B60B0ADD64EDF7196DA3773B6
- MD5 SHA1 SHA512 SSDEEP TLSH
siem-agent.exe
- IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
- SHA256 cfdf36ead468c1a33a25712f7f5f753271cb794b207c2639880ac9d4bbfd270f
- MD5 7a8e0f304bdf77e991dcec520c18bfbb
- SHA1 cfe7129de6b1e921166ef5107d0336eba7cbe807
- SHA512 ba8203e8d4f50d6b089290f80aa9abde55719878c94208609dbbaed4dd01a65dfb14675e03d2025cb942db93397d103c7fdaffe96bb36a26edda5ead1827b7df
- SSDEEP 49152:5U+wlqms/2kGUAJ8aJUX5SZPKJnQdCnc/WUwYbCsBsxwrTuttrXBWfpuYEpe8GOV:5Up0JSt3jrTQEUYbjCZnX3fe9rXEp7
- TLSH T195A64A17EDA644E8C0ADC2348A7692337B717C894B3163D71B54B624AF33BD4AEB9710
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
558496
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetProcAddress
LoadLibraryExW
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
QueryPerformanceCounter
PostQueuedCompletionStatus
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler
Name
.text
Size
4.6MB
Virtual Size
4.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4.6MB
Virtual Size
4.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
431KB
Virtual Size
32.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
100KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
91KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
uninstall.ps1
- SHA256 efe07eb057c5202f80b3b0571be94c5bfaf45bc08d3dd46f8fb0f9ee68f5f404
- MD5 8817d556fea2ceb0bf6c5cf127ce5850
- SHA1 04535fc9b33c72d3b73c6094c7561cad96d75b2f
- SHA512 809e36fd3b71b7299a56e4b41019658a9c6473e4db2003edd440f74609bec616d618f21b6c95d377c9ecb5f63f9fb9b00b72d3b1337d44d26c6eabf21978a513
- TLSH T18721AF0317A401E691C75F11DCC7AB8E362F58BE2449271078AE910767919AF4B7229A
- MD5 SHA1 SHA512 TLSH