9af983e73b75272f35d044305e92695af5073ad413e5e0c79f7e90dcf657b216

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03-10-2023 15:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c64d080c672d4dcaa073cddd1e145472_JC.exe
Size

260KB
MD5

c64d080c672d4dcaa073cddd1e145472
SHA1

e04ba6e1d9b21380fa389fee5e5f44535e2f068f
SHA256

9af983e73b75272f35d044305e92695af5073ad413e5e0c79f7e90dcf657b216
SHA512

732e1df20c85ec3852cbe65c5194928388805850be29c8677a94e3b286e4ea9abaa410b1cebdbd321141e7f1eb00ce1ad5b466ba6a95ec0af04b8618bdadd5f8
SSDEEP

3072:mePgCctxGv4QcU9KQ2BBA2waPxhtmolu1CWN29/SAJyj2:CCctxGsWKQ2Bx5xv61RN29SAA2

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1136	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
2980	c64d080c672d4dcaa073cddd1e145472_JC.exe
2980	c64d080c672d4dcaa073cddd1e145472_JC.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\202ca249\202ca249	c64d080c672d4dcaa073cddd1e145472_JC.exe
File created	C:\Program Files (x86)\202ca249\jusched.exe	c64d080c672d4dcaa073cddd1e145472_JC.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	c64d080c672d4dcaa073cddd1e145472_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 1136	2980	c64d080c672d4dcaa073cddd1e145472_JC.exe	28
PID 2980 wrote to memory of 1136	2980	c64d080c672d4dcaa073cddd1e145472_JC.exe	28
PID 2980 wrote to memory of 1136	2980	c64d080c672d4dcaa073cddd1e145472_JC.exe	28
PID 2980 wrote to memory of 1136	2980	c64d080c672d4dcaa073cddd1e145472_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\c64d080c672d4dcaa073cddd1e145472_JC.exe
"C:\Users\Admin\AppData\Local\Temp\c64d080c672d4dcaa073cddd1e145472_JC.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Program Files (x86)\202ca249\jusched.exe
  "C:\Program Files (x86)\202ca249\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:1136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\202ca249\202ca249

Filesize
17B

MD5
552bb86ed2797d3fd12ac0d273afaf75

SHA1
6e8633f9c24590779acbd3dd14c60f856320bc0a

SHA256
3ef9ff5da8272fd1b14c83f12c8d28fd9dbf32d56bcb714921032b02557fe789

SHA512
dab57227de02f4667cc8e2ec47566088b473caa0387caffbdfde37f3400da7d4f67dd222e83a4fa93592694bbcff7c52a2bcec074868baf221bc47d9370c8d2c

Download Submit
C:\Program Files (x86)\202ca249\jusched.exe

Filesize
260KB

MD5
537d3928b70b1af9cb228a8169cdee1d

SHA1
a740a32ec4a6c9dfaffe02433739f07ce9c79f88

SHA256
a0e02e4f30cf4af7dc4d64f589c8c3b299ddfcd562b595345f7277824f55c92c

SHA512
227bcf2a319542a585ce3b897294ddcc1b004e9b9c12390ef8e2e0d20f07b3d4d6e240f6088a31397766c22dd4ae4670973c549a1d2e20b42b8f4805acb083dc

Download Submit
C:\Program Files (x86)\202ca249\jusched.exe

Filesize
260KB

MD5
537d3928b70b1af9cb228a8169cdee1d

SHA1
a740a32ec4a6c9dfaffe02433739f07ce9c79f88

SHA256
a0e02e4f30cf4af7dc4d64f589c8c3b299ddfcd562b595345f7277824f55c92c

SHA512
227bcf2a319542a585ce3b897294ddcc1b004e9b9c12390ef8e2e0d20f07b3d4d6e240f6088a31397766c22dd4ae4670973c549a1d2e20b42b8f4805acb083dc

Download Submit
\Program Files (x86)\202ca249\jusched.exe

Filesize
260KB

MD5
537d3928b70b1af9cb228a8169cdee1d

SHA1
a740a32ec4a6c9dfaffe02433739f07ce9c79f88

SHA256
a0e02e4f30cf4af7dc4d64f589c8c3b299ddfcd562b595345f7277824f55c92c

SHA512
227bcf2a319542a585ce3b897294ddcc1b004e9b9c12390ef8e2e0d20f07b3d4d6e240f6088a31397766c22dd4ae4670973c549a1d2e20b42b8f4805acb083dc

Download Submit
\Program Files (x86)\202ca249\jusched.exe

Filesize
260KB

MD5
537d3928b70b1af9cb228a8169cdee1d

SHA1
a740a32ec4a6c9dfaffe02433739f07ce9c79f88

SHA256
a0e02e4f30cf4af7dc4d64f589c8c3b299ddfcd562b595345f7277824f55c92c

SHA512
227bcf2a319542a585ce3b897294ddcc1b004e9b9c12390ef8e2e0d20f07b3d4d6e240f6088a31397766c22dd4ae4670973c549a1d2e20b42b8f4805acb083dc

Download Submit
memory/1136-14-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2980-0-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2980-12-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2980-7-0x0000000002550000-0x00000000025A3000-memory.dmp

Filesize
332KB

Download