53e5a1ebc8909a37735be6b7aa5826f641a5f459589af6708b29c058e0441bec

General

Target

53e5a1ebc8909a37735be6b7aa5826f641a5f459589af6708b29c058e0441bec.exe
Size

483KB
MD5

fd5c85881f220f8b1e61417c412068eb
SHA1

3c055834527dd7d3dc064b452f98b42c307298b1
SHA256

53e5a1ebc8909a37735be6b7aa5826f641a5f459589af6708b29c058e0441bec
SHA512

3dbc64a8429f0f838bcdaf7572de4beee43039306c12b65627ac2fa432981aef9f3b8d2fb29ba4084e89c4050b4bf8bc16ca1fe723cc5a84ffe7e8ae5ce5bec8
SSDEEP

6144:2VTqrW9Q2dMtLrg4zhStfz1Sr8xgDsUh4zhStfz1NDsUh4zhSoZ:2V2rW9H+t3871Tot71NS

Score

10^/10

persistence

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.byethost12.com
Port:
21
Username:
b12_8082975
Password:
951753zx

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1984	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
852	53e5a1ebc8909a37735be6b7aa5826f641a5f459589af6708b29c058e0441bec.exe
852	53e5a1ebc8909a37735be6b7aa5826f641a5f459589af6708b29c058e0441bec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	53e5a1ebc8909a37735be6b7aa5826f641a5f459589af6708b29c058e0441bec.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	53e5a1ebc8909a37735be6b7aa5826f641a5f459589af6708b29c058e0441bec.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\bd256f2b\jusched.exe	53e5a1ebc8909a37735be6b7aa5826f641a5f459589af6708b29c058e0441bec.exe
File created	C:\Program Files (x86)\bd256f2b\bd256f2b	53e5a1ebc8909a37735be6b7aa5826f641a5f459589af6708b29c058e0441bec.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	53e5a1ebc8909a37735be6b7aa5826f641a5f459589af6708b29c058e0441bec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 1984	852	53e5a1ebc8909a37735be6b7aa5826f641a5f459589af6708b29c058e0441bec.exe	27
PID 852 wrote to memory of 1984	852	53e5a1ebc8909a37735be6b7aa5826f641a5f459589af6708b29c058e0441bec.exe	27
PID 852 wrote to memory of 1984	852	53e5a1ebc8909a37735be6b7aa5826f641a5f459589af6708b29c058e0441bec.exe	27
PID 852 wrote to memory of 1984	852	53e5a1ebc8909a37735be6b7aa5826f641a5f459589af6708b29c058e0441bec.exe	27

C:\Users\Admin\AppData\Local\Temp\53e5a1ebc8909a37735be6b7aa5826f641a5f459589af6708b29c058e0441bec.exe
"C:\Users\Admin\AppData\Local\Temp\53e5a1ebc8909a37735be6b7aa5826f641a5f459589af6708b29c058e0441bec.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:852
- C:\Program Files (x86)\bd256f2b\jusched.exe
  "C:\Program Files (x86)\bd256f2b\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:1984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\bd256f2b\bd256f2b

Filesize
17B

MD5
209aa6c14d66621f3aa1cee03a8bf5dc

SHA1
0f5bce2a29d3306586934b6d846a172078ee8e66

SHA256
57ef9e3c809cf3ca41782d4c7119c3ae7e43ccbb1c00d978b745677f14b82c2e

SHA512
8b9fb2bcc8e8785a48d3fe212f852c2f108ef2ab20e9e2a61e9bba5857002abe9111e42411bfc573e50c126031b7ef0433bddfa357de2ca0814f7d31157b9c63

Download Submit
C:\Program Files (x86)\bd256f2b\jusched.exe

Filesize
483KB

MD5
d33fc1e4947dfe533fb206eb97bcc308

SHA1
20cd82b5a5b343ee1a11d8f261f3fd4bf34b2a2a

SHA256
2b92fb335f455d8195a53e3a2224ebc56a53b0471f39f347b8e5fce6dd74d53f

SHA512
ba5e90c7475b5e7c4bdd368c1c3b9e74ddbc8b460a5a569df95b9c259287d0a92e10226cb7b71128a72147652f554f1734e6c0ff6275feb701039d1c1f1b9826

Download Submit
\Program Files (x86)\bd256f2b\jusched.exe

Filesize
483KB

MD5
d33fc1e4947dfe533fb206eb97bcc308

SHA1
20cd82b5a5b343ee1a11d8f261f3fd4bf34b2a2a

SHA256
2b92fb335f455d8195a53e3a2224ebc56a53b0471f39f347b8e5fce6dd74d53f

SHA512
ba5e90c7475b5e7c4bdd368c1c3b9e74ddbc8b460a5a569df95b9c259287d0a92e10226cb7b71128a72147652f554f1734e6c0ff6275feb701039d1c1f1b9826

Download Submit
\Program Files (x86)\bd256f2b\jusched.exe

Filesize
483KB

MD5
d33fc1e4947dfe533fb206eb97bcc308

SHA1
20cd82b5a5b343ee1a11d8f261f3fd4bf34b2a2a

SHA256
2b92fb335f455d8195a53e3a2224ebc56a53b0471f39f347b8e5fce6dd74d53f

SHA512
ba5e90c7475b5e7c4bdd368c1c3b9e74ddbc8b460a5a569df95b9c259287d0a92e10226cb7b71128a72147652f554f1734e6c0ff6275feb701039d1c1f1b9826

Download Submit
memory/852-54-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/852-55-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download
memory/852-60-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1984-61-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads