Resubmissions

13-06-2022 00:01

220613-aa4h5agfc9 10

12-05-2022 11:02

220512-m44r7sccd2 10

Analysis

  • max time kernel
    138s
  • max time network
    298s
  • platform
    windows10_x64
  • resource
    win10-20220414-en
  • submitted
    13-06-2022 00:01

General

  • Target

    ba8bd18660f8d9da758e35d8d777328dfce5166bfd60fa3a62011ac4abd226ab.exe

  • Size

    210.1MB

  • MD5

    1562c0e1c4a24abeff34aaa388a4aa53

  • SHA1

    67934a51c548fd77787cc26fa9952a8cd302970b

  • SHA256

    ba8bd18660f8d9da758e35d8d777328dfce5166bfd60fa3a62011ac4abd226ab

  • SHA512

    f3e5d23f2454fbe33d337ec4ca5dce81c8638c9d5cf2057db789991ced11888087f8a3da0d5fb0869d38957d6fd60984244065e095137f5a67cf070e8f5e6edb

Malware Config

Extracted

Family

jupyter

C2

http://37.120.247.120

Signatures

  • Jupyter, SolarMarker

    Jupyter is a backdoor and infostealer first seen in mid 2020.

  • suricata: ET MALWARE Jupyter Stealer CnC Checkin

    suricata: ET MALWARE Jupyter Stealer CnC Checkin

  • Blocklisted process makes network request 1 IoCs
  • Drops startup file 1 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ba8bd18660f8d9da758e35d8d777328dfce5166bfd60fa3a62011ac4abd226ab.exe
    "C:\Users\Admin\AppData\Local\Temp\ba8bd18660f8d9da758e35d8d777328dfce5166bfd60fa3a62011ac4abd226ab.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2932
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell"
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4040
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\m2slr0sk\m2slr0sk.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4340
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5E80.tmp" "c:\Users\Admin\AppData\Local\Temp\m2slr0sk\CSCA8B179817ABA4314ACF645DDFC6D16A1.TMP"
          4⤵
            PID:3708
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4368
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 2932 -s 944
        2⤵
        • Program crash
        PID:348

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

      Filesize

      50KB

      MD5

      2143b379fed61ab5450bab1a751798ce

      SHA1

      32f5b4e8d1387688ee5dec6b3cc6fd27b454f19e

      SHA256

      a2c739624812ada0913f2fbfe13228e7e42a20efdcb6d5c4e111964f9b620f81

      SHA512

      0bc39e3b666fdad76bcf4fe7e7729c9e8441aa2808173efc8030ce07c753cb5f7e25d81dd8ec75e7a5b6324b7504ff461e470023551976a2a6a415d6a4859bfa

    • C:\Users\Admin\AppData\Local\Temp\RES5E80.tmp

      Filesize

      1KB

      MD5

      7323216a4b3cb72a8e4b9e18769a63d7

      SHA1

      e35e0b917b06e1bc586d031a5e27cdec42db5c17

      SHA256

      1fd38a3bedb9b5e4337d8834eb2d1cfd87618959b92898accd49241b737bc900

      SHA512

      54ae2c3fa700a400973cc3ad437bfa4c359dccddfcf9012921bc598dde0aa513f44047793018fc75e3159dbfb5a171a6a2f40a6a39dfbc44e69800a8eed2eaab

    • C:\Users\Admin\AppData\Local\Temp\m2slr0sk\m2slr0sk.dll

      Filesize

      3KB

      MD5

      e2fc3e1ad6b1857e10377afba34315a2

      SHA1

      b8b239cb809359e0d9893fe993cbf5fe3076cd91

      SHA256

      f8c6fb96d781568e280d1c524b63a1932d7abbec6fc8558f6b2959ba360758dd

      SHA512

      7adc76e3c25c01c4786433f9d76c4b4876165ca455192847077e673c90731d9b741d87962961b7c31f72dd2afdb7729b743143968b90f171d48cdedb8c2848a3

    • \??\c:\Users\Admin\AppData\Local\Temp\m2slr0sk\CSCA8B179817ABA4314ACF645DDFC6D16A1.TMP

      Filesize

      652B

      MD5

      1c11d3ae5fd77a79312b6c30d0a66553

      SHA1

      96bf5d3745727569a87594103400b107da643152

      SHA256

      9956ebc42062cb7aa5317cb483dc43b4ae186ccb41cd7b57a7ef22b0abe9a7d9

      SHA512

      bc137488d97f6bfe6cbd5107c23d3b497e0b2618c5a78b8c4eb3f0946cb13dcbc516b869446710e8f25be5cad2d0c319302d7edf2d5f4b171ac12ef436ccb239

    • \??\c:\Users\Admin\AppData\Local\Temp\m2slr0sk\m2slr0sk.0.cs

      Filesize

      236B

      MD5

      2f9b4948ac0b26204994e246094a9f5d

      SHA1

      9870e53ad61eba593a2074d2a30202f7e3df09f7

      SHA256

      def6ec20884e30f8689cb1ccb8fb62735db528c5277f52f64ecae170cfd49776

      SHA512

      ef5f9056b36c8f9204a65b26244f225a9c2cc3bf5b1c46055e6eda06e63769243538b568b29627eb497289777fa69468e64b5eae0fb666bbb2e432a3059154d1

    • \??\c:\Users\Admin\AppData\Local\Temp\m2slr0sk\m2slr0sk.cmdline

      Filesize

      369B

      MD5

      1eeb07bec0c50ea3fde3eb7ebbf2696c

      SHA1

      9ab2dc69969b2b3567978960338ed5fb4bbdba06

      SHA256

      377c3d45039c7df67f3e1779059c0aceb6be66e4a97c745e956840d005fe16b4

      SHA512

      f0bcd40d1bfc147c367dd8660f95780c4cae5df7f85fb161270e70029d9e4e9f4c3fa4f826cd286ce366361f41d755f28781d10a3a3300166cd8bc286b10c626

    • memory/2932-114-0x0000000000720000-0x0000000001720000-memory.dmp

      Filesize

      16.0MB

    • memory/3708-233-0x0000000000000000-mapping.dmp

    • memory/4040-153-0x000002122E8F0000-0x000002122E966000-memory.dmp

      Filesize

      472KB

    • memory/4040-142-0x000002122E3E0000-0x000002122E41C000-memory.dmp

      Filesize

      240KB

    • memory/4040-121-0x000002122E240000-0x000002122E262000-memory.dmp

      Filesize

      136KB

    • memory/4040-237-0x000002122E3B0000-0x000002122E3B8000-memory.dmp

      Filesize

      32KB

    • memory/4040-115-0x0000000000000000-mapping.dmp

    • memory/4040-383-0x000002122E970000-0x000002122EA34000-memory.dmp

      Filesize

      784KB

    • memory/4340-230-0x0000000000000000-mapping.dmp

    • memory/4368-329-0x0000000000000000-mapping.dmp