Analysis

  • max time kernel
    130s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-10-2023 19:42

General

  • Target

    a60cf7efc2377fe9ed86a9fa2f4ba8f0_exe32.exe

  • Size

    224KB

  • MD5

    a60cf7efc2377fe9ed86a9fa2f4ba8f0

  • SHA1

    acbe5f92322a52c2f56baa3b6046f0e941e8fb83

  • SHA256

    8a09833749c4d48210e885688a7f1208d4a96c00a1ea5c925b0bea552e0f09d3

  • SHA512

    f5f37e2c47f43b6e762fd838677a522f8c0c4953dd329ed24959e45090cda6020873d9a78d6e2a719ce8d3ba742c3ce24aa6f9ea10deb05b3d78479a3de1c24c

  • SSDEEP

    1536:HvV6iLUWGI3UmkFlgZLu6xXXq5pm9AKTrSrowl+Oy:HvV6iUW5UmkH+lxX6Tmwrowl5y

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a60cf7efc2377fe9ed86a9fa2f4ba8f0_exe32.exe
    "C:\Users\Admin\AppData\Local\Temp\a60cf7efc2377fe9ed86a9fa2f4ba8f0_exe32.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:748
    • C:\Program Files (x86)\28a89378\jusched.exe
      "C:\Program Files (x86)\28a89378\jusched.exe"
      2⤵
      • Executes dropped EXE
      PID:828

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\28a89378\28a89378

    Filesize

    17B

    MD5

    7bdf61d37c9adf3e1c6937107016091f

    SHA1

    56b8e0c454f9dd16d508a04b3afa7e458453ac41

    SHA256

    4c57d86c256214baa0a5a3322ef5cdd575210455b7e964ad60382bd9d4be12e0

    SHA512

    ff4fc1a427c84f47042375749f45ee6edea73b902ae977f14243ebceb7b9a28f41fe5dd404e3ea381754d9122202bc6b61ed0152b20a1c1be76c225dd20861d1

  • C:\Program Files (x86)\28a89378\jusched.exe

    Filesize

    224KB

    MD5

    2006f825619ab5db04a0cee5f34c8eea

    SHA1

    99d13ea8f22e08f08e31b00adc5f9e0def6c7fb7

    SHA256

    cdae350c163b31c8d33dbe3f35119e0696baecf5709ee84e37086ad2ef9f6ffe

    SHA512

    20524e0546ca588b37a269cc7618fcea9689097a53aeb755ce7ee41c92d3d9ebabec55a5c25a3382f4a2628c415f8dba67e396b8f75eb2d66dc00896f7595ef3

  • C:\Program Files (x86)\28a89378\jusched.exe

    Filesize

    224KB

    MD5

    2006f825619ab5db04a0cee5f34c8eea

    SHA1

    99d13ea8f22e08f08e31b00adc5f9e0def6c7fb7

    SHA256

    cdae350c163b31c8d33dbe3f35119e0696baecf5709ee84e37086ad2ef9f6ffe

    SHA512

    20524e0546ca588b37a269cc7618fcea9689097a53aeb755ce7ee41c92d3d9ebabec55a5c25a3382f4a2628c415f8dba67e396b8f75eb2d66dc00896f7595ef3

  • C:\Program Files (x86)\28a89378\jusched.exe

    Filesize

    224KB

    MD5

    2006f825619ab5db04a0cee5f34c8eea

    SHA1

    99d13ea8f22e08f08e31b00adc5f9e0def6c7fb7

    SHA256

    cdae350c163b31c8d33dbe3f35119e0696baecf5709ee84e37086ad2ef9f6ffe

    SHA512

    20524e0546ca588b37a269cc7618fcea9689097a53aeb755ce7ee41c92d3d9ebabec55a5c25a3382f4a2628c415f8dba67e396b8f75eb2d66dc00896f7595ef3

  • memory/748-0-0x0000000000400000-0x0000000000448000-memory.dmp

    Filesize

    288KB

  • memory/748-15-0x0000000000400000-0x0000000000448000-memory.dmp

    Filesize

    288KB

  • memory/828-14-0x0000000000400000-0x0000000000448000-memory.dmp

    Filesize

    288KB

  • memory/828-16-0x0000000000400000-0x0000000000448000-memory.dmp

    Filesize

    288KB