d20d772f1d4f55e999a7d9b353a532a0fe5dfa4c62377a3a8b1d442cf3f1a646

General

Target

d20d772f1d4f55e999a7d9b353a532a0fe5dfa4c62377a3a8b1d442cf3f1a646.exe
Size

208KB
MD5

2536bb5dc8c4bf730e40f362c20b7a50
SHA1

9d8029f486d2fa9b84c20c430d6aa4dcea0b8b45
SHA256

d20d772f1d4f55e999a7d9b353a532a0fe5dfa4c62377a3a8b1d442cf3f1a646
SHA512

6233b0f0c8c22591b064766a7218e5ccb72dbde9d875f6bd2acf249bcf585c6fe23c49478cb2223604ee274bde97b7496a9b114a510e9f5b40e8e04ed02831d5
SSDEEP

3072:nVHgCc4xGvbwcU9KQ2BBAHmaPxiVoSb5Ev:OCc4xGxWKQ2BonxF

Score

10^/10

persistence

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.byethost12.com
Port:
21
Username:
b12_8082975
Password:
951753zx

Signatures

Executes dropped EXE 1 IoCs

Processes:

jusched.exe

pid process

1200 jusched.exe

pid	process
1200	jusched.exe

Loads dropped DLL 2 IoCs

Processes:

d20d772f1d4f55e999a7d9b353a532a0fe5dfa4c62377a3a8b1d442cf3f1a646.exe

pid	process
1600	d20d772f1d4f55e999a7d9b353a532a0fe5dfa4c62377a3a8b1d442cf3f1a646.exe
1600	d20d772f1d4f55e999a7d9b353a532a0fe5dfa4c62377a3a8b1d442cf3f1a646.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

d20d772f1d4f55e999a7d9b353a532a0fe5dfa4c62377a3a8b1d442cf3f1a646.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	d20d772f1d4f55e999a7d9b353a532a0fe5dfa4c62377a3a8b1d442cf3f1a646.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	d20d772f1d4f55e999a7d9b353a532a0fe5dfa4c62377a3a8b1d442cf3f1a646.exe

Drops file in Program Files directory 2 IoCs

Processes:

d20d772f1d4f55e999a7d9b353a532a0fe5dfa4c62377a3a8b1d442cf3f1a646.exe

description	ioc	process
File created	C:\Program Files (x86)\908e782d\jusched.exe	d20d772f1d4f55e999a7d9b353a532a0fe5dfa4c62377a3a8b1d442cf3f1a646.exe
File created	C:\Program Files (x86)\908e782d\908e782d	d20d772f1d4f55e999a7d9b353a532a0fe5dfa4c62377a3a8b1d442cf3f1a646.exe

Drops file in Windows directory 1 IoCs

Processes:

d20d772f1d4f55e999a7d9b353a532a0fe5dfa4c62377a3a8b1d442cf3f1a646.exe

description ioc process

File created C:\Windows\Tasks\Update23.job d20d772f1d4f55e999a7d9b353a532a0fe5dfa4c62377a3a8b1d442cf3f1a646.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Tasks\Update23.job	d20d772f1d4f55e999a7d9b353a532a0fe5dfa4c62377a3a8b1d442cf3f1a646.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

d20d772f1d4f55e999a7d9b353a532a0fe5dfa4c62377a3a8b1d442cf3f1a646.exe

description	pid	process	target process
PID 1600 wrote to memory of 1200	1600	d20d772f1d4f55e999a7d9b353a532a0fe5dfa4c62377a3a8b1d442cf3f1a646.exe	jusched.exe
PID 1600 wrote to memory of 1200	1600	d20d772f1d4f55e999a7d9b353a532a0fe5dfa4c62377a3a8b1d442cf3f1a646.exe	jusched.exe
PID 1600 wrote to memory of 1200	1600	d20d772f1d4f55e999a7d9b353a532a0fe5dfa4c62377a3a8b1d442cf3f1a646.exe	jusched.exe
PID 1600 wrote to memory of 1200	1600	d20d772f1d4f55e999a7d9b353a532a0fe5dfa4c62377a3a8b1d442cf3f1a646.exe	jusched.exe

C:\Users\Admin\AppData\Local\Temp\d20d772f1d4f55e999a7d9b353a532a0fe5dfa4c62377a3a8b1d442cf3f1a646.exe
"C:\Users\Admin\AppData\Local\Temp\d20d772f1d4f55e999a7d9b353a532a0fe5dfa4c62377a3a8b1d442cf3f1a646.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1600

C:\Program Files (x86)\908e782d\jusched.exe
"C:\Program Files (x86)\908e782d\jusched.exe"
2⤵
- Executes dropped EXE
PID:1200

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\908e782d\908e782d
Filesize
17B

MD5
134c1d489094d6d3399f65b0e9aebc1f

SHA1
612a57fbe6ed3ab9c15b39451171d813314a28d5

SHA256
54f9150d1268f7b4b83dd9fc3ec32274bf749715a5806ff3ca5262f5427d6781

SHA512
b09bf60e4850d05261d81a124a647dd111f42480224eae8a3bd2f64736c38119953703f868ad34194a7ae6dad6aabff4081ba73df262bbe9f5327867c56a48ed

Download Submit
C:\Program Files (x86)\908e782d\jusched.exe
Filesize
208KB

MD5
001d504352c016e586ea3a92f5fd85b2

SHA1
7a760dd08728aaee4f9dca35942df8bb04f5aa58

SHA256
76f45ef358dfd892769a836568516f65ff786694b9b7455ead9fc5965c673dd5

SHA512
1ed62f7d98605a07ddd986e3cfc10311b0b09d362aade68e7a5db138474e53f51061c12c7bec40c4708d4cac0503a0d7616ab22dbfb2142c79e3c39e06cfc007

Download Submit
\Program Files (x86)\908e782d\jusched.exe
Filesize
208KB

MD5
001d504352c016e586ea3a92f5fd85b2

SHA1
7a760dd08728aaee4f9dca35942df8bb04f5aa58

SHA256
76f45ef358dfd892769a836568516f65ff786694b9b7455ead9fc5965c673dd5

SHA512
1ed62f7d98605a07ddd986e3cfc10311b0b09d362aade68e7a5db138474e53f51061c12c7bec40c4708d4cac0503a0d7616ab22dbfb2142c79e3c39e06cfc007

Download Submit
\Program Files (x86)\908e782d\jusched.exe
Filesize
208KB

MD5
001d504352c016e586ea3a92f5fd85b2

SHA1
7a760dd08728aaee4f9dca35942df8bb04f5aa58

SHA256
76f45ef358dfd892769a836568516f65ff786694b9b7455ead9fc5965c673dd5

SHA512
1ed62f7d98605a07ddd986e3cfc10311b0b09d362aade68e7a5db138474e53f51061c12c7bec40c4708d4cac0503a0d7616ab22dbfb2142c79e3c39e06cfc007

Download Submit
memory/1200-57-0x0000000000000000-mapping.dmp

Download
memory/1600-54-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads