siem-agent-windows-amd64-1.14.0.zip
- SHA256 2092b6adc41fbedf00d2d7ba258cd7383048e6bb8ec33e5e44328975f1a81ad8
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
install.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
install.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
siem-agent.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
siem-agent.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
uninstall.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
uninstall.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target siem-agent-windows-amd64-1.14.0.zip
- Size 4.0MB
- Sample261104-tbee6sbt2z
- SHA256 2092b6adc41fbedf00d2d7ba258cd7383048e6bb8ec33e5e44328975f1a81ad8
- MD5 799041140db038d2830ad3aa58380611
- SHA1 3ad134e06aa59cecf3a1ed29ae3911537a04a066
- SHA512 16b9db6e025c54287c2e6e06f11d4838183af279721309d232ac5b7a8ba1387918fc68efa9122efca5a6965ca51ea668a65356136ef6489309671fef0aec6490
- SSDEEP 98304:8wQB+GxGu6EU/bdcbmK2LR2RhGljyjy83pnfIcGr5I76lBtMeEMA2:EMGxGuybWbCgyljyW8ZwFe4BtMbB2
- TLSH T1A91633E418FB1E9C9FDC311C0CA726E79644F48C7E64059CEE75CF4877662B180A52AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/siem-agent.exe
File Explorer
-
siem-agent-windows-amd64-1.14.0.zip.zip 4.0MB
-
config.yaml1KB
-
install.ps1.ps1 4KB
-
siem-agent.exe.exe 9.8MB
-
uninstall.ps1.ps1 1KB
config.yaml
- SHA256 9d75af66305e09ddbfe78a771577f01e15279438635f4c11b093a1147204afb5
- MD5 c68e668fd27be4d56e8d449e9d2942ed
- SHA1 cae6ccbd2db53776735dcbff45ffc9cd71ed90a7
- SHA512 dfe5ff6b2c988b92f1920011f4cc3b92ee354def607925435307facda2d29c2aebf13f120bd8fdd5226d64e04668b0cceb606b21dcacbe2fa7cf12d1556399c2
- TLSH T1DD415681061E5134E96A1236EF9EA3C61735E7DAF34128B03A9D5D28B31258B81126E9
- MD5 SHA1 SHA512 TLSH
install.ps1
- SHA256 347566fc71daff44bb63e1c2cb3e0bb28af63764ad0b41dd4e07e7d91eebc6d4
- MD5 b3667f798d0361867ae1e299f53c1d06
- SHA1 ddfeaee63675a20cc329c3863ff78718f52afd32
- SHA512 53e5ba7d23d16bcb55d7780837c35a3c8fc390e3d1ba2cbe1254cde4ae474121310f4bc97ccf8c272bd921c3f080f349ddc3eec09cd25f07bb34b291b0247081
- SSDEEP 96:kPgRAm6tbzcWJpWJv1fu4ub8u/ifXzCS7q/gEKceJ73UIKI:ygRAbtHcapWfGmjCS7q/gEVeJzUI
- TLSH T1DC91B825E43803A18EB0DF98ECA4688C7D1F00570A653B60B0ADD64EDF7196DA3773B6
- MD5 SHA1 SHA512 SSDEEP TLSH
siem-agent.exe
- IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
- SHA256 76b93a5cc25532806cf22e60a747e0e63b9583b0b6926dc98e3d19869076753d
- MD5 3ab97498d8ab6887c5dca6c222a88b12
- SHA1 a6a267331d96f807458ce3cd1487e1bafbef68a1
- SHA512 b86ac74cc35351e878f8cf28ccc8f461e4b00cc91dc4a474b952c7f79398b504c4a90aa80cae1326b3fa838c2ae3619c23db940ac2c89f89217ebc0126cb70e1
- SSDEEP 98304:vHrsOS86jdBJWKQvEIMZnTMr3t2iG+EsX:vAzfIWnIgsX
- TLSH T11BA63817EDA954E5C0ADC6348A7692237B707C494B3163D72F90B6346F32BE0AEB9350
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
558496
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetProcAddress
LoadLibraryExW
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
QueryPerformanceCounter
PostQueuedCompletionStatus
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler
Name
.text
Size
4.6MB
Virtual Size
4.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4.6MB
Virtual Size
4.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
431KB
Virtual Size
32.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
100KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
91KB
Virtual Size
90KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
uninstall.ps1
- SHA256 efe07eb057c5202f80b3b0571be94c5bfaf45bc08d3dd46f8fb0f9ee68f5f404
- MD5 8817d556fea2ceb0bf6c5cf127ce5850
- SHA1 04535fc9b33c72d3b73c6094c7561cad96d75b2f
- SHA512 809e36fd3b71b7299a56e4b41019658a9c6473e4db2003edd440f74609bec616d618f21b6c95d377c9ecb5f63f9fb9b00b72d3b1337d44d26c6eabf21978a513
- TLSH T18721AF0317A401E691C75F11DCC7AB8E362F58BE2449271078AE910767919AF4B7229A
- MD5 SHA1 SHA512 TLSH