c1de413b01aa4ce75600167762fe06330fbc7e561b79ea2aa03b327a84ce159a

General

Target

c1de413b01aa4ce75600167762fe06330fbc7e561b79ea2aa03b327a84ce159a.exe
Size

230KB
MD5

ec8b19847fa199a42b474fd2bceff8c1
SHA1

8602b5b93718c8475655838a3e437bec543c68a3
SHA256

c1de413b01aa4ce75600167762fe06330fbc7e561b79ea2aa03b327a84ce159a
SHA512

a5b1a5ed8d2806cc58bbc25b30f55e4b168a36a0ce1b14d07bc90f2bc1ce890803a5033500c17d85a321877f27a9d269419f2cc1bf98b417e21377ffa48a5acc
SSDEEP

3072:oChJgYMm4xf9cU9KQ2BxA59SPMqOo1n2/:4YMm4xiWKQ2BiCMZ

Score

10^/10

persistence

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1124	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
856	c1de413b01aa4ce75600167762fe06330fbc7e561b79ea2aa03b327a84ce159a.exe
856	c1de413b01aa4ce75600167762fe06330fbc7e561b79ea2aa03b327a84ce159a.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	c1de413b01aa4ce75600167762fe06330fbc7e561b79ea2aa03b327a84ce159a.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	c1de413b01aa4ce75600167762fe06330fbc7e561b79ea2aa03b327a84ce159a.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\9caffec2\jusched.exe	c1de413b01aa4ce75600167762fe06330fbc7e561b79ea2aa03b327a84ce159a.exe
File created	C:\Program Files (x86)\9caffec2\9caffec2	c1de413b01aa4ce75600167762fe06330fbc7e561b79ea2aa03b327a84ce159a.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	c1de413b01aa4ce75600167762fe06330fbc7e561b79ea2aa03b327a84ce159a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 1124	856	c1de413b01aa4ce75600167762fe06330fbc7e561b79ea2aa03b327a84ce159a.exe	27
PID 856 wrote to memory of 1124	856	c1de413b01aa4ce75600167762fe06330fbc7e561b79ea2aa03b327a84ce159a.exe	27
PID 856 wrote to memory of 1124	856	c1de413b01aa4ce75600167762fe06330fbc7e561b79ea2aa03b327a84ce159a.exe	27
PID 856 wrote to memory of 1124	856	c1de413b01aa4ce75600167762fe06330fbc7e561b79ea2aa03b327a84ce159a.exe	27

C:\Users\Admin\AppData\Local\Temp\c1de413b01aa4ce75600167762fe06330fbc7e561b79ea2aa03b327a84ce159a.exe
"C:\Users\Admin\AppData\Local\Temp\c1de413b01aa4ce75600167762fe06330fbc7e561b79ea2aa03b327a84ce159a.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:856
- C:\Program Files (x86)\9caffec2\jusched.exe
  "C:\Program Files (x86)\9caffec2\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:1124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\9caffec2\9caffec2

Filesize
17B

MD5
89931a70501a3362b6823b53523f5a77

SHA1
88c7e199c462ed8cc3af0ba453512b5b1fdcfdb5

SHA256
d30d9a0e64bc9f4a306617f087f30de6d57a5413793ab7bde13a299777a1b254

SHA512
8fa7ab4824ae86f3f47b3718c11f79ef275dd0639396572eaeb1262ad9153ccf43c633a7b292e30c97370436a09f22fbcf817a802015650ffb1f84d2b83483bd

Download Submit
C:\Program Files (x86)\9caffec2\jusched.exe

Filesize
230KB

MD5
296881051e1b37a8c21dbb411413d430

SHA1
102d5363391e1b5ee88def8f30cd286252b82188

SHA256
38b15bf8fdf4df802d393714b63678c018801a80283f89e2928925245745b3a4

SHA512
3874b9ae37fd76ce97dace5a560e34a59584cad04bfe8ec5b00ae95bbb5d05834465865f91885c60d4ea3041366978e0b7d61512ddb0423efb56e7ce3126f2f7

Download Submit
\Program Files (x86)\9caffec2\jusched.exe

Filesize
230KB

MD5
296881051e1b37a8c21dbb411413d430

SHA1
102d5363391e1b5ee88def8f30cd286252b82188

SHA256
38b15bf8fdf4df802d393714b63678c018801a80283f89e2928925245745b3a4

SHA512
3874b9ae37fd76ce97dace5a560e34a59584cad04bfe8ec5b00ae95bbb5d05834465865f91885c60d4ea3041366978e0b7d61512ddb0423efb56e7ce3126f2f7

Download Submit
\Program Files (x86)\9caffec2\jusched.exe

Filesize
230KB

MD5
296881051e1b37a8c21dbb411413d430

SHA1
102d5363391e1b5ee88def8f30cd286252b82188

SHA256
38b15bf8fdf4df802d393714b63678c018801a80283f89e2928925245745b3a4

SHA512
3874b9ae37fd76ce97dace5a560e34a59584cad04bfe8ec5b00ae95bbb5d05834465865f91885c60d4ea3041366978e0b7d61512ddb0423efb56e7ce3126f2f7

Download Submit
memory/856-54-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/856-55-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/856-56-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/856-61-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1124-59-0x0000000000000000-mapping.dmp

Download
memory/1124-62-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing