Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
10/04/2024, 18:41
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
0db8ca15096f8d3877fb75093f25e3e858e50332d547b6a78c7f4acaa1da34f6.exe
Resource
win7-20240215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
0db8ca15096f8d3877fb75093f25e3e858e50332d547b6a78c7f4acaa1da34f6.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
0db8ca15096f8d3877fb75093f25e3e858e50332d547b6a78c7f4acaa1da34f6.exe
-
Size
41KB
-
MD5
fe6f947f8a83695f53aff514fbc7b5b2
-
SHA1
ab2be2b7773db48226b9781f07fab54ae0501b43
-
SHA256
0db8ca15096f8d3877fb75093f25e3e858e50332d547b6a78c7f4acaa1da34f6
-
SHA512
6d5e70af475f982ac19775d9beb2d4df96cf8030916cf560f37640757a7a1d49eca403abadc3acb0505f5681fd87228a4615fec1349f0d53005de96ab64d4891
-
SSDEEP
768:xIP5WOMVs4PSV06ymNNC6S7Cm1n2OBGRIWNSE77DPQ1TTGfGYhb:xI0OGrOy6NvSpMZrQ1J2
Score
10/10
Malware Config
Extracted
Credentials
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
griptoloji - Password:
741852
Signatures
-
Detects executables built or packed with MPress PE compressor 7 IoCs
resource yara_rule behavioral1/memory/1932-0-0x0000000000400000-0x0000000000473000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/files/0x0030000000015d44-5.dat INDICATOR_EXE_Packed_MPress behavioral1/memory/1932-12-0x0000000000400000-0x0000000000473000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2980-14-0x0000000000400000-0x0000000000473000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/1932-7-0x00000000041A0000-0x0000000004213000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2980-20-0x0000000000400000-0x0000000000473000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2980-21-0x0000000000400000-0x0000000000473000-memory.dmp INDICATOR_EXE_Packed_MPress -
Executes dropped EXE 1 IoCs
pid Process 2980 jusched.exe -
Loads dropped DLL 2 IoCs
pid Process 1932 0db8ca15096f8d3877fb75093f25e3e858e50332d547b6a78c7f4acaa1da34f6.exe 1932 0db8ca15096f8d3877fb75093f25e3e858e50332d547b6a78c7f4acaa1da34f6.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\Java\jre-09\bin\jusched.exe 0db8ca15096f8d3877fb75093f25e3e858e50332d547b6a78c7f4acaa1da34f6.exe File opened for modification C:\Program Files (x86)\Java\jre-09\bin\jusched.exe 0db8ca15096f8d3877fb75093f25e3e858e50332d547b6a78c7f4acaa1da34f6.exe File created C:\Program Files (x86)\Java\jre-09\bin\UF 0db8ca15096f8d3877fb75093f25e3e858e50332d547b6a78c7f4acaa1da34f6.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe 2980 jusched.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1932 wrote to memory of 2980 1932 0db8ca15096f8d3877fb75093f25e3e858e50332d547b6a78c7f4acaa1da34f6.exe 28 PID 1932 wrote to memory of 2980 1932 0db8ca15096f8d3877fb75093f25e3e858e50332d547b6a78c7f4acaa1da34f6.exe 28 PID 1932 wrote to memory of 2980 1932 0db8ca15096f8d3877fb75093f25e3e858e50332d547b6a78c7f4acaa1da34f6.exe 28 PID 1932 wrote to memory of 2980 1932 0db8ca15096f8d3877fb75093f25e3e858e50332d547b6a78c7f4acaa1da34f6.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\0db8ca15096f8d3877fb75093f25e3e858e50332d547b6a78c7f4acaa1da34f6.exe"C:\Users\Admin\AppData\Local\Temp\0db8ca15096f8d3877fb75093f25e3e858e50332d547b6a78c7f4acaa1da34f6.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Program Files (x86)\Java\jre-09\bin\jusched.exe"C:\Program Files (x86)\Java\jre-09\bin\jusched.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2980
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD5e5e763ce9dd5207525f4edde606a1783
SHA1e79da1ec4b5d91930f9e27a6261056253d403c55
SHA2561f570283cd8125aa020b891294f3296842d9b929df9a5a799a800ceb1b81c5c7
SHA5127bc80635202694f29c9c1577d6f77fa6cbcad797848b801cfed7a2919c5b2db3a590569cf8e0ce9ef45865832629fe43a35176c8bab4d8dd0040275fd47759c4