02f54c5ffde68cf7932537839ba31f0d825de18e2e472543f0db409c622b7557

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 17:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02f54c5ffde68cf7932537839ba31f0d825de18e2e472543f0db409c622b7557.exe
Size

216KB
MD5

f3adc6a2dfd5da230cbf44d3b7b7fe61
SHA1

c92fe5a63149edcc306423ec1aeaf58a7997d7f3
SHA256

02f54c5ffde68cf7932537839ba31f0d825de18e2e472543f0db409c622b7557
SHA512

b3e3caa2dfea6b074c6a04d3afa7b4aead26c94a6079cce4ce1fe38de056eef7bcecd04bedb02ef5b53649a44b5739c7f909496905883a32f87e158401006596
SSDEEP

3072:HePgHctxGv4QcU9KQ2BBA2waPxVtmolhK1r:THctxGsWKQ2Bx5xjt8r

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.byethost12.com
Port:
21
Username:
b12_8082975
Password:
951753zx

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	02f54c5ffde68cf7932537839ba31f0d825de18e2e472543f0db409c622b7557.exe

Executes dropped EXE 1 IoCs

pid	Process
544	jusched.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\a5a5ba94\jusched.exe	02f54c5ffde68cf7932537839ba31f0d825de18e2e472543f0db409c622b7557.exe
File created	C:\Program Files (x86)\a5a5ba94\a5a5ba94	02f54c5ffde68cf7932537839ba31f0d825de18e2e472543f0db409c622b7557.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	02f54c5ffde68cf7932537839ba31f0d825de18e2e472543f0db409c622b7557.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 544	1720	02f54c5ffde68cf7932537839ba31f0d825de18e2e472543f0db409c622b7557.exe	92
PID 1720 wrote to memory of 544	1720	02f54c5ffde68cf7932537839ba31f0d825de18e2e472543f0db409c622b7557.exe	92
PID 1720 wrote to memory of 544	1720	02f54c5ffde68cf7932537839ba31f0d825de18e2e472543f0db409c622b7557.exe	92

C:\Users\Admin\AppData\Local\Temp\02f54c5ffde68cf7932537839ba31f0d825de18e2e472543f0db409c622b7557.exe
"C:\Users\Admin\AppData\Local\Temp\02f54c5ffde68cf7932537839ba31f0d825de18e2e472543f0db409c622b7557.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Program Files (x86)\a5a5ba94\jusched.exe
  "C:\Program Files (x86)\a5a5ba94\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\a5a5ba94\a5a5ba94

Filesize
17B

MD5
552bb86ed2797d3fd12ac0d273afaf75

SHA1
6e8633f9c24590779acbd3dd14c60f856320bc0a

SHA256
3ef9ff5da8272fd1b14c83f12c8d28fd9dbf32d56bcb714921032b02557fe789

SHA512
dab57227de02f4667cc8e2ec47566088b473caa0387caffbdfde37f3400da7d4f67dd222e83a4fa93592694bbcff7c52a2bcec074868baf221bc47d9370c8d2c

Download Submit
C:\Program Files (x86)\a5a5ba94\jusched.exe

Filesize
216KB

MD5
b18a082bb4395477b30279b54e0a3037

SHA1
5357862f5ed23ed6a0b0ddc2d3d1f2ed950bd6de

SHA256
9a3832b3864db34e6ee4f3c89c1ca3e1fe74c90ab5c19b4d376dc755c20d7278

SHA512
dc213e81b9c9b5606271ce827e1dc7858f57081adc645c93553fd6b2fc82ca1b82136a8b4fd67a47bf5805097f96c410be7ea0c3d367d389612d7b17cf2a99b9

Download Submit
memory/544-15-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1720-0-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1720-14-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download