c5c4ec085b2a6de07886170556cbb8df20d699716e520b46fdfad09cf697790f

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/04/2024, 02:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c5c4ec085b2a6de07886170556cbb8df20d699716e520b46fdfad09cf697790f.exe
Size

211KB
MD5

1781926557e5016f61aa3ea9f0b20338
SHA1

4a028c0f0dd10a9f422f6cfbdf45d77afdf9dc4d
SHA256

c5c4ec085b2a6de07886170556cbb8df20d699716e520b46fdfad09cf697790f
SHA512

a1fe7a67fc0e9e745549c777576de49fa2e54b59ea3a3e5a57ac78e810f161fa81130b0d6a61bdaa4e827efee624df39c332cd7e3b49fafbd01b58aa153957da
SSDEEP

3072:nVHgCc4xGvbwcU9KQ2BBAHmaPxiVoSb5EdU:OCc4xGxWKQ2BonxfU

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2468	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
2456	c5c4ec085b2a6de07886170556cbb8df20d699716e520b46fdfad09cf697790f.exe
2456	c5c4ec085b2a6de07886170556cbb8df20d699716e520b46fdfad09cf697790f.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\fb9ab06\jusched.exe	c5c4ec085b2a6de07886170556cbb8df20d699716e520b46fdfad09cf697790f.exe
File created	C:\Program Files (x86)\fb9ab06\fb9ab06	c5c4ec085b2a6de07886170556cbb8df20d699716e520b46fdfad09cf697790f.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	c5c4ec085b2a6de07886170556cbb8df20d699716e520b46fdfad09cf697790f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 2468	2456	c5c4ec085b2a6de07886170556cbb8df20d699716e520b46fdfad09cf697790f.exe	28
PID 2456 wrote to memory of 2468	2456	c5c4ec085b2a6de07886170556cbb8df20d699716e520b46fdfad09cf697790f.exe	28
PID 2456 wrote to memory of 2468	2456	c5c4ec085b2a6de07886170556cbb8df20d699716e520b46fdfad09cf697790f.exe	28
PID 2456 wrote to memory of 2468	2456	c5c4ec085b2a6de07886170556cbb8df20d699716e520b46fdfad09cf697790f.exe	28

C:\Users\Admin\AppData\Local\Temp\c5c4ec085b2a6de07886170556cbb8df20d699716e520b46fdfad09cf697790f.exe
"C:\Users\Admin\AppData\Local\Temp\c5c4ec085b2a6de07886170556cbb8df20d699716e520b46fdfad09cf697790f.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Program Files (x86)\fb9ab06\jusched.exe
  "C:\Program Files (x86)\fb9ab06\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\fb9ab06\fb9ab06

Filesize
17B

MD5
134c1d489094d6d3399f65b0e9aebc1f

SHA1
612a57fbe6ed3ab9c15b39451171d813314a28d5

SHA256
54f9150d1268f7b4b83dd9fc3ec32274bf749715a5806ff3ca5262f5427d6781

SHA512
b09bf60e4850d05261d81a124a647dd111f42480224eae8a3bd2f64736c38119953703f868ad34194a7ae6dad6aabff4081ba73df262bbe9f5327867c56a48ed

Download Submit
\Program Files (x86)\fb9ab06\jusched.exe

Filesize
211KB

MD5
e3b2be3b45094690a633aefab335651a

SHA1
d5f567af3537066a73194a1114597c63d99fc57c

SHA256
47904e8c3934929466ce968b269d642bb45015d848bf483f00d8b07fa67a4fe5

SHA512
63134c8b265aa03975f7890daa980df104b512a3a400c9b937937cb8fce5a0b9c28409c241a3409a910671645d0417cec70a5d783499943532d991686aa2a1d3

Download Submit