02f54c5ffde68cf7932537839ba31f0d825de18e2e472543f0db409c622b7557

Analysis

max time kernel
149s
max time network
137s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 17:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02f54c5ffde68cf7932537839ba31f0d825de18e2e472543f0db409c622b7557.exe
Size

216KB
MD5

f3adc6a2dfd5da230cbf44d3b7b7fe61
SHA1

c92fe5a63149edcc306423ec1aeaf58a7997d7f3
SHA256

02f54c5ffde68cf7932537839ba31f0d825de18e2e472543f0db409c622b7557
SHA512

b3e3caa2dfea6b074c6a04d3afa7b4aead26c94a6079cce4ce1fe38de056eef7bcecd04bedb02ef5b53649a44b5739c7f909496905883a32f87e158401006596
SSDEEP

3072:HePgHctxGv4QcU9KQ2BBA2waPxVtmolhK1r:THctxGsWKQ2Bx5xjt8r

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.byethost12.com
Port:
21
Username:
b12_8082975
Password:
951753zx

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1756	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
2240	02f54c5ffde68cf7932537839ba31f0d825de18e2e472543f0db409c622b7557.exe
2240	02f54c5ffde68cf7932537839ba31f0d825de18e2e472543f0db409c622b7557.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\3e44419c\jusched.exe	02f54c5ffde68cf7932537839ba31f0d825de18e2e472543f0db409c622b7557.exe
File created	C:\Program Files (x86)\3e44419c\3e44419c	02f54c5ffde68cf7932537839ba31f0d825de18e2e472543f0db409c622b7557.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	02f54c5ffde68cf7932537839ba31f0d825de18e2e472543f0db409c622b7557.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1756	2240	02f54c5ffde68cf7932537839ba31f0d825de18e2e472543f0db409c622b7557.exe	28
PID 2240 wrote to memory of 1756	2240	02f54c5ffde68cf7932537839ba31f0d825de18e2e472543f0db409c622b7557.exe	28
PID 2240 wrote to memory of 1756	2240	02f54c5ffde68cf7932537839ba31f0d825de18e2e472543f0db409c622b7557.exe	28
PID 2240 wrote to memory of 1756	2240	02f54c5ffde68cf7932537839ba31f0d825de18e2e472543f0db409c622b7557.exe	28

C:\Users\Admin\AppData\Local\Temp\02f54c5ffde68cf7932537839ba31f0d825de18e2e472543f0db409c622b7557.exe
"C:\Users\Admin\AppData\Local\Temp\02f54c5ffde68cf7932537839ba31f0d825de18e2e472543f0db409c622b7557.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files (x86)\3e44419c\jusched.exe
  "C:\Program Files (x86)\3e44419c\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:1756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\3e44419c\3e44419c

Filesize
17B

MD5
552bb86ed2797d3fd12ac0d273afaf75

SHA1
6e8633f9c24590779acbd3dd14c60f856320bc0a

SHA256
3ef9ff5da8272fd1b14c83f12c8d28fd9dbf32d56bcb714921032b02557fe789

SHA512
dab57227de02f4667cc8e2ec47566088b473caa0387caffbdfde37f3400da7d4f67dd222e83a4fa93592694bbcff7c52a2bcec074868baf221bc47d9370c8d2c

Download Submit
\Program Files (x86)\3e44419c\jusched.exe

Filesize
216KB

MD5
252c51a98e2514163353b7a1b65c1e39

SHA1
d79fe329b3a5f81cad2752f698b7cf085a162251

SHA256
ad45429fd266109883ed0b5247961737e4cbd933d5beaacedf02743b7cba6056

SHA512
014da51ac3bfa5ff17551915d72dbaa95f7b5917b0571605dd9933467c45845ca13815a130190911a89ec8075401d2ce836d8760a77326924bc01d8fba065fb0

Download Submit
memory/1756-15-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2240-0-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2240-12-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2240-13-0x00000000026F0000-0x0000000002746000-memory.dmp

Filesize
344KB

Download
memory/2240-7-0x00000000026F0000-0x0000000002746000-memory.dmp

Filesize
344KB

Download