Analysis
- max time kernel
141s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20230831-en - resource tags
- submitted
02/09/2023, 10:57
General
- Target JC_39c0f284ba8ff38e9d3461cbf14e8be05c5979b514d393565442eb29a81598bd.exe
- Size 10.2MB
- Sample230902-m2sbdscd74
- SHA256 39c0f284ba8ff38e9d3461cbf14e8be05c5979b514d393565442eb29a81598bd
Malware Config
Extracted
-
Protocol
ftp
-
Host
103.73.163.10
-
Port
21
-
Username
123
-
Password
123123
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JC_39c0f284ba8ff38e9d3461cbf14e8be05c5979b514d393565442eb29a81598bd.exe"C:\Users\Admin\AppData\Local\Temp\JC_39c0f284ba8ff38e9d3461cbf14e8be05c5979b514d393565442eb29a81598bd.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3884-2-0x00000000736F0000-0x0000000073EA0000-memory.dmp
memory/3884-3-0x0000000005DC0000-0x0000000005DD0000-memory.dmp
memory/3884-4-0x0000000005DC0000-0x0000000005DD0000-memory.dmp
memory/3884-5-0x0000000005DD0000-0x0000000006374000-memory.dmp
memory/3884-7-0x0000000077431000-0x0000000077432000-memory.dmp
memory/3884-8-0x00000000069D0000-0x0000000006A62000-memory.dmp
memory/3884-9-0x0000000006A80000-0x0000000006A8A000-memory.dmp
memory/3884-10-0x0000000006D10000-0x0000000006DAC000-memory.dmp
memory/3884-11-0x0000000006DD0000-0x0000000006E36000-memory.dmp
memory/3884-12-0x00000000736F0000-0x0000000073EA0000-memory.dmp
memory/3884-14-0x0000000005DC0000-0x0000000005DD0000-memory.dmp