39961846fd6cbd3fee80abc78b0cc489964dceb9c77197608f4fbdb16316d73f

General

Target

39961846fd6cbd3fee80abc78b0cc489964dceb9c77197608f4fbdb16316d73f.exe
Size

2.5MB
MD5

eca95fbb69ab3ba58f0f535c0e481d67
SHA1

82f2092667e20ef4992d13a428102d64176b4b9e
SHA256

39961846fd6cbd3fee80abc78b0cc489964dceb9c77197608f4fbdb16316d73f
SHA512

3646cf1f9a1fcd854f4ad63ce1bcd451319efd27c21255279add937a9060f32c15d944aa8b4df1712bcf600703614c66c57144061ac09afd4bbec89a4612e3ff
SSDEEP

49152:vhDZlDTeHumcu6x06hZJYtF2EGvxyhXQu8GqbilpEVWi26kAdSNl:ZVlExGT2tF2rCXrVlScJAoz

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	39961846fd6cbd3fee80abc78b0cc489964dceb9c77197608f4fbdb16316d73f.exe

Executes dropped EXE 1 IoCs

pid	Process
2596	jusched.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs

pid	Process
1720	39961846fd6cbd3fee80abc78b0cc489964dceb9c77197608f4fbdb16316d73f.exe
2596	jusched.exe
2596	jusched.exe
2596	jusched.exe
2596	jusched.exe
2596	jusched.exe
2596	jusched.exe
2596	jusched.exe
2596	jusched.exe
2596	jusched.exe
2596	jusched.exe
2596	jusched.exe
2596	jusched.exe
2596	jusched.exe
2596	jusched.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\8b27473d\jusched.exe	39961846fd6cbd3fee80abc78b0cc489964dceb9c77197608f4fbdb16316d73f.exe
File created	C:\Program Files (x86)\8b27473d\8b27473d	39961846fd6cbd3fee80abc78b0cc489964dceb9c77197608f4fbdb16316d73f.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	39961846fd6cbd3fee80abc78b0cc489964dceb9c77197608f4fbdb16316d73f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1720	39961846fd6cbd3fee80abc78b0cc489964dceb9c77197608f4fbdb16316d73f.exe
2596	jusched.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2596	1720	39961846fd6cbd3fee80abc78b0cc489964dceb9c77197608f4fbdb16316d73f.exe	92
PID 1720 wrote to memory of 2596	1720	39961846fd6cbd3fee80abc78b0cc489964dceb9c77197608f4fbdb16316d73f.exe	92
PID 1720 wrote to memory of 2596	1720	39961846fd6cbd3fee80abc78b0cc489964dceb9c77197608f4fbdb16316d73f.exe	92

C:\Users\Admin\AppData\Local\Temp\39961846fd6cbd3fee80abc78b0cc489964dceb9c77197608f4fbdb16316d73f.exe
"C:\Users\Admin\AppData\Local\Temp\39961846fd6cbd3fee80abc78b0cc489964dceb9c77197608f4fbdb16316d73f.exe"
1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Program Files (x86)\8b27473d\jusched.exe
  "C:\Program Files (x86)\8b27473d\jusched.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\8b27473d\8b27473d

Filesize
17B

MD5
4d77d6b250ffb567743b8dbcdad695b8

SHA1
d5a8f98f9433f6d36c74df463cef3e2cf524462d

SHA256
7ec7a3a23890c3592f5b762aecf11adbf8831fad11b8048aedfa7315d599c5f2

SHA512
5655153049101fd67125d484c81f1ad30b44f36f00e3aabfe8d730a21661f4b394357b60da549289def4311b4cc7bd508d8fd6b8db254cd442b2152f8902bd71

Download Submit
C:\Program Files (x86)\8b27473d\jusched.exe

Filesize
2.5MB

MD5
8689992dcb93525e8f6c9f00211fc4a1

SHA1
4187b48abdae39ba80e772ad4f4f10c3cb43b216

SHA256
0af868792cc37a2f5440f6896c8781a568d10aab5751ed66c8d8d9b266daf921

SHA512
e415bd72145137e3f8935cca30f510a9af48fd2c5fe8ce8dcf5b01a375c4c9c1a4b4922198c31e10ef853475f8983b1d9e1302bdf2e311e3825e87fd8f91af93

Download Submit
memory/1720-18-0x000000007FA70000-0x000000007FE41000-memory.dmp

Filesize
3.8MB

Download
memory/1720-1-0x000000007FA70000-0x000000007FE41000-memory.dmp

Filesize
3.8MB

Download
memory/1720-15-0x0000000000400000-0x0000000000E0F000-memory.dmp

Filesize
10.1MB

Download
memory/1720-0-0x0000000000400000-0x0000000000E0F000-memory.dmp

Filesize
10.1MB

Download
memory/2596-22-0x0000000000400000-0x0000000000E0F000-memory.dmp

Filesize
10.1MB

Download
memory/2596-27-0x0000000000400000-0x0000000000E0F000-memory.dmp

Filesize
10.1MB

Download
memory/2596-20-0x0000000000400000-0x0000000000E0F000-memory.dmp

Filesize
10.1MB

Download
memory/2596-21-0x000000007FA70000-0x000000007FE41000-memory.dmp

Filesize
3.8MB

Download
memory/2596-17-0x000000007FA70000-0x000000007FE41000-memory.dmp

Filesize
3.8MB

Download
memory/2596-23-0x0000000000400000-0x0000000000E0F000-memory.dmp

Filesize
10.1MB

Download
memory/2596-24-0x0000000000400000-0x0000000000E0F000-memory.dmp

Filesize
10.1MB

Download
memory/2596-16-0x0000000000400000-0x0000000000E0F000-memory.dmp

Filesize
10.1MB

Download
memory/2596-26-0x0000000000400000-0x0000000000E0F000-memory.dmp

Filesize
10.1MB

Download
memory/2596-19-0x0000000000400000-0x0000000000E0F000-memory.dmp

Filesize
10.1MB

Download
memory/2596-28-0x0000000000400000-0x0000000000E0F000-memory.dmp

Filesize
10.1MB

Download
memory/2596-29-0x0000000000400000-0x0000000000E0F000-memory.dmp

Filesize
10.1MB

Download
memory/2596-30-0x0000000000400000-0x0000000000E0F000-memory.dmp

Filesize
10.1MB

Download
memory/2596-31-0x0000000000400000-0x0000000000E0F000-memory.dmp

Filesize
10.1MB

Download
memory/2596-32-0x0000000000400000-0x0000000000E0F000-memory.dmp

Filesize
10.1MB

Download
memory/2596-33-0x0000000000400000-0x0000000000E0F000-memory.dmp

Filesize
10.1MB

Download
memory/2596-34-0x0000000000400000-0x0000000000E0F000-memory.dmp

Filesize
10.1MB

Download

Analysis

Sharing