c4261fa7e40e1be389cfc1278792e89020d9660a46c88ade187beef0405910c8

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c4261fa7e40e1be389cfc1278792e89020d9660a46c88ade187beef0405910c8.exe
Size

46KB
MD5

86e5a136186cff25661ee485a7cd4dcf
SHA1

1e2b95ffcc1e70014cf787578e85abcf07230aad
SHA256

c4261fa7e40e1be389cfc1278792e89020d9660a46c88ade187beef0405910c8
SHA512

cd2cde25b1c3b2f4297b409a4c8f7a60249c03ff88fc5c2ef50bb26d8922b5d0db1563821d462e39a3d85cbd39351c6bee04e050ca3ae4e8fe6efc3286ea8f4f
SSDEEP

768:6zQYScGrIubHuYtv0xwYHw5FAe2Qxncwx8Nwv92emBevS68:8QTIubHR5wQxAyFvSh

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	c4261fa7e40e1be389cfc1278792e89020d9660a46c88ade187beef0405910c8.exe

Executes dropped EXE 1 IoCs

pid	Process
1020	jusched.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\22b4c1e3\jusched.exe	c4261fa7e40e1be389cfc1278792e89020d9660a46c88ade187beef0405910c8.exe
File created	C:\Program Files (x86)\22b4c1e3\22b4c1e3	c4261fa7e40e1be389cfc1278792e89020d9660a46c88ade187beef0405910c8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 1020	3664	c4261fa7e40e1be389cfc1278792e89020d9660a46c88ade187beef0405910c8.exe	95
PID 3664 wrote to memory of 1020	3664	c4261fa7e40e1be389cfc1278792e89020d9660a46c88ade187beef0405910c8.exe	95
PID 3664 wrote to memory of 1020	3664	c4261fa7e40e1be389cfc1278792e89020d9660a46c88ade187beef0405910c8.exe	95

C:\Users\Admin\AppData\Local\Temp\c4261fa7e40e1be389cfc1278792e89020d9660a46c88ade187beef0405910c8.exe
"C:\Users\Admin\AppData\Local\Temp\c4261fa7e40e1be389cfc1278792e89020d9660a46c88ade187beef0405910c8.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Program Files (x86)\22b4c1e3\jusched.exe
  "C:\Program Files (x86)\22b4c1e3\jusched.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3808 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:4944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\22b4c1e3\22b4c1e3

Filesize
13B

MD5
f253efe302d32ab264a76e0ce65be769

SHA1
768685ca582abd0af2fbb57ca37752aa98c9372b

SHA256
49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd

SHA512
1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4

Download Submit
C:\Program Files (x86)\22b4c1e3\jusched.exe

Filesize
46KB

MD5
f68fe69354c020d1b12bdc6fcd450976

SHA1
1ddebcfd8224f61a76aafb83cec2d65f5a95abc1

SHA256
02eeda010b33da896f3a152c8d3aac776157f27733b8d5f692ea343b607b3d94

SHA512
56863a77193049f31bc3d7b2fe66ef18e3bc4965a71da19793afb1e96e3885763eebf0507b033a9bdf932600e567c3b3d5c22d617fc22a26c48a7b8086c1acbd

Download Submit
memory/1020-10-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3664-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3664-11-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download