Analysis
-
max time kernel
149s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/03/2024, 20:39
Static task
static1
Behavioral task
behavioral1
Sample
5ec7655084f6ffe8c4ef087ca3d9a4fcad074bb0aed042f1da3b5a927ce82b4c.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
5ec7655084f6ffe8c4ef087ca3d9a4fcad074bb0aed042f1da3b5a927ce82b4c.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
General
-
Target
5ec7655084f6ffe8c4ef087ca3d9a4fcad074bb0aed042f1da3b5a927ce82b4c.exe
-
Size
43KB
-
MD5
29c89def486b830de5ca98424b9d5724
-
SHA1
20a3c17b54a4f760e13c78fe334b71ffe3a2f041
-
SHA256
5ec7655084f6ffe8c4ef087ca3d9a4fcad074bb0aed042f1da3b5a927ce82b4c
-
SHA512
c8a3359dc094bc99da5097bf7735a3a4667a305dcd4ac93c23af53ec1aa1a4b9c88b3c688da8d62a8f72ad0f5775a3490530c13a017e71a11b86a50b5f0f9798
-
SSDEEP
768:kflivXrVKpVhKvtxwYHwVFoeAQ+mucwUKzdlPPKK:alqrVKprVuQ+7z7Pp
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2176 jusched.exe -
Loads dropped DLL 2 IoCs
pid Process 2200 5ec7655084f6ffe8c4ef087ca3d9a4fcad074bb0aed042f1da3b5a927ce82b4c.exe 2200 5ec7655084f6ffe8c4ef087ca3d9a4fcad074bb0aed042f1da3b5a927ce82b4c.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\81bf8279\jusched.exe 5ec7655084f6ffe8c4ef087ca3d9a4fcad074bb0aed042f1da3b5a927ce82b4c.exe File created C:\Program Files (x86)\81bf8279\81bf8279 5ec7655084f6ffe8c4ef087ca3d9a4fcad074bb0aed042f1da3b5a927ce82b4c.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe 2176 jusched.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2200 wrote to memory of 2176 2200 5ec7655084f6ffe8c4ef087ca3d9a4fcad074bb0aed042f1da3b5a927ce82b4c.exe 28 PID 2200 wrote to memory of 2176 2200 5ec7655084f6ffe8c4ef087ca3d9a4fcad074bb0aed042f1da3b5a927ce82b4c.exe 28 PID 2200 wrote to memory of 2176 2200 5ec7655084f6ffe8c4ef087ca3d9a4fcad074bb0aed042f1da3b5a927ce82b4c.exe 28 PID 2200 wrote to memory of 2176 2200 5ec7655084f6ffe8c4ef087ca3d9a4fcad074bb0aed042f1da3b5a927ce82b4c.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ec7655084f6ffe8c4ef087ca3d9a4fcad074bb0aed042f1da3b5a927ce82b4c.exe"C:\Users\Admin\AppData\Local\Temp\5ec7655084f6ffe8c4ef087ca3d9a4fcad074bb0aed042f1da3b5a927ce82b4c.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Program Files (x86)\81bf8279\jusched.exe"C:\Program Files (x86)\81bf8279\jusched.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2176
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13B
MD5f253efe302d32ab264a76e0ce65be769
SHA1768685ca582abd0af2fbb57ca37752aa98c9372b
SHA25649dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
SHA5121990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
-
Filesize
43KB
MD5f59ad2b828417f09822d488bfda3d21f
SHA1722529f3c30a8a0c0e19f503915353d114c8b572
SHA2563ce79905113d2344525de80b3a0678300e202f03405dea768e294d6315324869
SHA512c6143515890dc6cff54aa8c798ef4a4fa0a9325ba40b714554a63bfc1efa744fbcf56236955bf5af5b27990ace53dc9565e08796d87bad702948184756d6b455