siem-agent-windows-amd64-1.13.0.zip
- SHA256 1172c61c541e86b21bec685608c63d398c5d5e1ad5d38cd6e1540e7f38021497
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
install.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
install.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
siem-agent.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
siem-agent.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
uninstall.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
uninstall.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target siem-agent-windows-amd64-1.13.0.zip
- Size 4.0MB
- Sample261104-tbfm8sdx7m
- SHA256 1172c61c541e86b21bec685608c63d398c5d5e1ad5d38cd6e1540e7f38021497
- MD5 29448d986f9aa05711e5387fad15d9c6
- SHA1 ee3a60107474d7459e7d6f4ceeec4beb6ee06872
- SHA512 32a2da0ae00a0dc347dc9646cc87082a96c952e3eaf0d52d3312998ee895927819b0d421dd260785faace05e50c93d3b31dcf180d70169542eecefd16daf8dc7
- SSDEEP 98304:Iv5E/y57Kt++rJT9BCJzmHqz3m1FPf7/CVw3EA6rB/8EpP:GJutFA+qz3m1VCWEj/11
- TLSH T14816333EFAE19639A58DC8D771C2C528F9111D9CC7CB8DB5B1EC7D818B21881EDA4293
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/siem-agent.exe
File Explorer
-
siem-agent-windows-amd64-1.13.0.zip.zip 4.0MB
-
config.yaml1KB
-
install.ps1.ps1 4KB
-
siem-agent.exe.exe 9.8MB
-
uninstall.ps1.ps1 1KB
config.yaml
- SHA256 9d75af66305e09ddbfe78a771577f01e15279438635f4c11b093a1147204afb5
- MD5 c68e668fd27be4d56e8d449e9d2942ed
- SHA1 cae6ccbd2db53776735dcbff45ffc9cd71ed90a7
- SHA512 dfe5ff6b2c988b92f1920011f4cc3b92ee354def607925435307facda2d29c2aebf13f120bd8fdd5226d64e04668b0cceb606b21dcacbe2fa7cf12d1556399c2
- TLSH T1DD415681061E5134E96A1236EF9EA3C61735E7DAF34128B03A9D5D28B31258B81126E9
- MD5 SHA1 SHA512 TLSH
install.ps1
- SHA256 347566fc71daff44bb63e1c2cb3e0bb28af63764ad0b41dd4e07e7d91eebc6d4
- MD5 b3667f798d0361867ae1e299f53c1d06
- SHA1 ddfeaee63675a20cc329c3863ff78718f52afd32
- SHA512 53e5ba7d23d16bcb55d7780837c35a3c8fc390e3d1ba2cbe1254cde4ae474121310f4bc97ccf8c272bd921c3f080f349ddc3eec09cd25f07bb34b291b0247081
- SSDEEP 96:kPgRAm6tbzcWJpWJv1fu4ub8u/ifXzCS7q/gEKceJ73UIKI:ygRAbtHcapWfGmjCS7q/gEVeJzUI
- TLSH T1DC91B825E43803A18EB0DF98ECA4688C7D1F00570A653B60B0ADD64EDF7196DA3773B6
- MD5 SHA1 SHA512 SSDEEP TLSH
siem-agent.exe
- IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
- SHA256 6f2cec9f3cec8ef55b11928c7861ca739a836876ad21305b6bfc78f3bcca7714
- MD5 b3fda3be1643ca250655b574af54b4ea
- SHA1 c92e18bd354026ae6e88e17699094dea8781ae34
- SHA512 2ec19f09acbf78f618ce8ebeffb6b95d25aed7b20ca03a32e6aa56c92d6b720b200d13cbbf7aeccd6dd424a7875ff325492ad4ce963834735ffc280c70ddf6eb
- SSDEEP 98304:mIriWwxIHU94HeZSrgBZn8M6btLxbiEwQ:mqtoyg3n+7wQ
- TLSH T1A9A64953ECA555E8C0AED5348A7692237B707C884B3123D72B50F6246F33BE4ADBA354
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
558496
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetProcAddress
LoadLibraryExW
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
QueryPerformanceCounter
PostQueuedCompletionStatus
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler
Name
.text
Size
4.6MB
Virtual Size
4.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4.6MB
Virtual Size
4.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
431KB
Virtual Size
32.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
90KB
Virtual Size
90KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
uninstall.ps1
- SHA256 efe07eb057c5202f80b3b0571be94c5bfaf45bc08d3dd46f8fb0f9ee68f5f404
- MD5 8817d556fea2ceb0bf6c5cf127ce5850
- SHA1 04535fc9b33c72d3b73c6094c7561cad96d75b2f
- SHA512 809e36fd3b71b7299a56e4b41019658a9c6473e4db2003edd440f74609bec616d618f21b6c95d377c9ecb5f63f9fb9b00b72d3b1337d44d26c6eabf21978a513
- TLSH T18721AF0317A401E691C75F11DCC7AB8E362F58BE2449271078AE910767919AF4B7229A
- MD5 SHA1 SHA512 TLSH