fda2a0883de1ffd5a2187e451067dd13e928ff4966af92a68e97515a8246498d

Analysis

max time kernel
128s
max time network
128s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
01/10/2023, 11:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d45374b46c82a682797573c724eacdc_JC.exe
Size

378KB
MD5

1d45374b46c82a682797573c724eacdc
SHA1

632e0062c53712a8c8ec71174bac34b81a758e70
SHA256

fda2a0883de1ffd5a2187e451067dd13e928ff4966af92a68e97515a8246498d
SHA512

e0fda598baf0c052ba8eea18ad2047e5c97f67bcabeba1040200b031fb2d2b2c160c8e2e940aa4d54053699eeda67b7268884f1b180ccd5568809ed53bd810a8
SSDEEP

6144:YVTarW9Q2dT6VPAKovnQUvmmAF7J77777S40XB8:YVmrW9HGPGvnQUvmmAF7J77777SnXB8

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.byethost12.com
Port:
21
Username:
b12_8082975
Password:
951753zx

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1464	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
2320	1d45374b46c82a682797573c724eacdc_JC.exe
2320	1d45374b46c82a682797573c724eacdc_JC.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\4bea8411\jusched.exe	1d45374b46c82a682797573c724eacdc_JC.exe
File created	C:\Program Files (x86)\4bea8411\4bea8411	1d45374b46c82a682797573c724eacdc_JC.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	1d45374b46c82a682797573c724eacdc_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 1464	2320	1d45374b46c82a682797573c724eacdc_JC.exe	28
PID 2320 wrote to memory of 1464	2320	1d45374b46c82a682797573c724eacdc_JC.exe	28
PID 2320 wrote to memory of 1464	2320	1d45374b46c82a682797573c724eacdc_JC.exe	28
PID 2320 wrote to memory of 1464	2320	1d45374b46c82a682797573c724eacdc_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\1d45374b46c82a682797573c724eacdc_JC.exe
"C:\Users\Admin\AppData\Local\Temp\1d45374b46c82a682797573c724eacdc_JC.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\4bea8411\jusched.exe
  "C:\Program Files (x86)\4bea8411\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:1464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\4bea8411\4bea8411

Filesize
17B

MD5
209aa6c14d66621f3aa1cee03a8bf5dc

SHA1
0f5bce2a29d3306586934b6d846a172078ee8e66

SHA256
57ef9e3c809cf3ca41782d4c7119c3ae7e43ccbb1c00d978b745677f14b82c2e

SHA512
8b9fb2bcc8e8785a48d3fe212f852c2f108ef2ab20e9e2a61e9bba5857002abe9111e42411bfc573e50c126031b7ef0433bddfa357de2ca0814f7d31157b9c63

Download Submit
C:\Program Files (x86)\4bea8411\jusched.exe

Filesize
378KB

MD5
0029b39370f389ba3911b40f45a96ba4

SHA1
a6872074f9443255beb05a601d3fad2a0bf6a020

SHA256
41a767de492f159b039a039e7cd391e01bc90c0c14dc27181c82ce91837a9b6a

SHA512
abc9b8e4116a2bf388c55b1ed70af58fccf0c64a16c0ee784123781a2b7766c4491d7677427e187fc858d32fa4d575fde0da75836757ebd4d2f46d00498868df

Download Submit
C:\Program Files (x86)\4bea8411\jusched.exe

Filesize
378KB

MD5
0029b39370f389ba3911b40f45a96ba4

SHA1
a6872074f9443255beb05a601d3fad2a0bf6a020

SHA256
41a767de492f159b039a039e7cd391e01bc90c0c14dc27181c82ce91837a9b6a

SHA512
abc9b8e4116a2bf388c55b1ed70af58fccf0c64a16c0ee784123781a2b7766c4491d7677427e187fc858d32fa4d575fde0da75836757ebd4d2f46d00498868df

Download Submit
\Program Files (x86)\4bea8411\jusched.exe

Filesize
378KB

MD5
0029b39370f389ba3911b40f45a96ba4

SHA1
a6872074f9443255beb05a601d3fad2a0bf6a020

SHA256
41a767de492f159b039a039e7cd391e01bc90c0c14dc27181c82ce91837a9b6a

SHA512
abc9b8e4116a2bf388c55b1ed70af58fccf0c64a16c0ee784123781a2b7766c4491d7677427e187fc858d32fa4d575fde0da75836757ebd4d2f46d00498868df

Download Submit
\Program Files (x86)\4bea8411\jusched.exe

Filesize
378KB

MD5
0029b39370f389ba3911b40f45a96ba4

SHA1
a6872074f9443255beb05a601d3fad2a0bf6a020

SHA256
41a767de492f159b039a039e7cd391e01bc90c0c14dc27181c82ce91837a9b6a

SHA512
abc9b8e4116a2bf388c55b1ed70af58fccf0c64a16c0ee784123781a2b7766c4491d7677427e187fc858d32fa4d575fde0da75836757ebd4d2f46d00498868df

Download Submit
memory/1464-14-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2320-0-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2320-7-0x00000000027C0000-0x000000000282C000-memory.dmp

Filesize
432KB

Download
memory/2320-12-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads