c124c69360c2dbf5e147d91dff11ac5717eef894bc2ccacf419aa5977603f2d8

General

Target

c124c69360c2dbf5e147d91dff11ac5717eef894bc2ccacf419aa5977603f2d8.exe
Size

189KB
MD5

90c9cef61c766c9a9f3a0f304a5b9590
SHA1

3a009b11b162a39d30f58529a0cd60544bcb3d2a
SHA256

c124c69360c2dbf5e147d91dff11ac5717eef894bc2ccacf419aa5977603f2d8
SHA512

b2e1469d1bf01a558fe0881efee4512988bb4ad2165c822dc2dedd0d47a6a0d445489246ea5e5c18a5ca284085555a5c6c3171691c63897229127666eaa662e6
SSDEEP

1536:SvVQb4cLIkN+4Weat2RKLjWlC48Pp9JAcjrSrowugo:SvVQLIkLWeaA8KlCph9Growugo

Score

10^/10

persistence

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1784	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
1972	c124c69360c2dbf5e147d91dff11ac5717eef894bc2ccacf419aa5977603f2d8.exe
1972	c124c69360c2dbf5e147d91dff11ac5717eef894bc2ccacf419aa5977603f2d8.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	c124c69360c2dbf5e147d91dff11ac5717eef894bc2ccacf419aa5977603f2d8.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	c124c69360c2dbf5e147d91dff11ac5717eef894bc2ccacf419aa5977603f2d8.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\41d4fa46\jusched.exe	c124c69360c2dbf5e147d91dff11ac5717eef894bc2ccacf419aa5977603f2d8.exe
File created	C:\Program Files (x86)\41d4fa46\41d4fa46	c124c69360c2dbf5e147d91dff11ac5717eef894bc2ccacf419aa5977603f2d8.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	c124c69360c2dbf5e147d91dff11ac5717eef894bc2ccacf419aa5977603f2d8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1784	1972	c124c69360c2dbf5e147d91dff11ac5717eef894bc2ccacf419aa5977603f2d8.exe	28
PID 1972 wrote to memory of 1784	1972	c124c69360c2dbf5e147d91dff11ac5717eef894bc2ccacf419aa5977603f2d8.exe	28
PID 1972 wrote to memory of 1784	1972	c124c69360c2dbf5e147d91dff11ac5717eef894bc2ccacf419aa5977603f2d8.exe	28
PID 1972 wrote to memory of 1784	1972	c124c69360c2dbf5e147d91dff11ac5717eef894bc2ccacf419aa5977603f2d8.exe	28

C:\Users\Admin\AppData\Local\Temp\c124c69360c2dbf5e147d91dff11ac5717eef894bc2ccacf419aa5977603f2d8.exe
"C:\Users\Admin\AppData\Local\Temp\c124c69360c2dbf5e147d91dff11ac5717eef894bc2ccacf419aa5977603f2d8.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Program Files (x86)\41d4fa46\jusched.exe
  "C:\Program Files (x86)\41d4fa46\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:1784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\41d4fa46\41d4fa46

Filesize
17B

MD5
7bdf61d37c9adf3e1c6937107016091f

SHA1
56b8e0c454f9dd16d508a04b3afa7e458453ac41

SHA256
4c57d86c256214baa0a5a3322ef5cdd575210455b7e964ad60382bd9d4be12e0

SHA512
ff4fc1a427c84f47042375749f45ee6edea73b902ae977f14243ebceb7b9a28f41fe5dd404e3ea381754d9122202bc6b61ed0152b20a1c1be76c225dd20861d1

Download Submit
C:\Program Files (x86)\41d4fa46\jusched.exe

Filesize
189KB

MD5
f10ff0198c72a7a3ade043df348d90a3

SHA1
33071c25082761fe2cd7af2c9640f65b79cb0034

SHA256
4a596095fce1f3642356453934b7912cdde6c3cf62fa1784c5a0330af2e8bbfb

SHA512
b33da85e44891921d16e3f255681a5299189e0cf934c7ddb138c5d9da35492f982515386e215c9551664f0965d0f2eb7fc95042c463f31a079af7599e527ebf2

Download Submit
\Program Files (x86)\41d4fa46\jusched.exe

Filesize
189KB

MD5
f10ff0198c72a7a3ade043df348d90a3

SHA1
33071c25082761fe2cd7af2c9640f65b79cb0034

SHA256
4a596095fce1f3642356453934b7912cdde6c3cf62fa1784c5a0330af2e8bbfb

SHA512
b33da85e44891921d16e3f255681a5299189e0cf934c7ddb138c5d9da35492f982515386e215c9551664f0965d0f2eb7fc95042c463f31a079af7599e527ebf2

Download Submit
\Program Files (x86)\41d4fa46\jusched.exe

Filesize
189KB

MD5
f10ff0198c72a7a3ade043df348d90a3

SHA1
33071c25082761fe2cd7af2c9640f65b79cb0034

SHA256
4a596095fce1f3642356453934b7912cdde6c3cf62fa1784c5a0330af2e8bbfb

SHA512
b33da85e44891921d16e3f255681a5299189e0cf934c7ddb138c5d9da35492f982515386e215c9551664f0965d0f2eb7fc95042c463f31a079af7599e527ebf2

Download Submit
memory/1784-58-0x0000000000000000-mapping.dmp

Download
memory/1784-61-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1972-54-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1972-55-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download
memory/1972-60-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing