6434f68c677ed3d9ecf60cf3895c4bdf0d2a2761d497d8490ecd7767acf20a0b

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/04/2024, 22:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6434f68c677ed3d9ecf60cf3895c4bdf0d2a2761d497d8490ecd7767acf20a0b.exe
Size

338KB
MD5

bdcb97c4b014c370560571f3c4e101ae
SHA1

23c25b0f8b17a11f7a686b4af4f8e071ebc78b83
SHA256

6434f68c677ed3d9ecf60cf3895c4bdf0d2a2761d497d8490ecd7767acf20a0b
SHA512

aa93e174ed7b226dcb9aae7f8e36de3cf3a2f0b5fe6c652e02e49d338dd108a7abe4ea9789092cb4731c02d5563eca1ead49f1eb0c7d1faddceb6b84fff83b87
SSDEEP

3072:N53mQ7JtnP5I09qgmBBAWgjSvwx/o0WBAYEQ3/AeohItgs6CFtIaxv8gD8Lll0Qo:bmKJtna2qgmBNgQwwAw/SItgtwt0p5bM

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2916	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
2324	6434f68c677ed3d9ecf60cf3895c4bdf0d2a2761d497d8490ecd7767acf20a0b.exe
2324	6434f68c677ed3d9ecf60cf3895c4bdf0d2a2761d497d8490ecd7767acf20a0b.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\9b8995fe\jusched.exe	6434f68c677ed3d9ecf60cf3895c4bdf0d2a2761d497d8490ecd7767acf20a0b.exe
File created	C:\Program Files (x86)\9b8995fe\9b8995fe	6434f68c677ed3d9ecf60cf3895c4bdf0d2a2761d497d8490ecd7767acf20a0b.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	6434f68c677ed3d9ecf60cf3895c4bdf0d2a2761d497d8490ecd7767acf20a0b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2916	2324	6434f68c677ed3d9ecf60cf3895c4bdf0d2a2761d497d8490ecd7767acf20a0b.exe	28
PID 2324 wrote to memory of 2916	2324	6434f68c677ed3d9ecf60cf3895c4bdf0d2a2761d497d8490ecd7767acf20a0b.exe	28
PID 2324 wrote to memory of 2916	2324	6434f68c677ed3d9ecf60cf3895c4bdf0d2a2761d497d8490ecd7767acf20a0b.exe	28
PID 2324 wrote to memory of 2916	2324	6434f68c677ed3d9ecf60cf3895c4bdf0d2a2761d497d8490ecd7767acf20a0b.exe	28

C:\Users\Admin\AppData\Local\Temp\6434f68c677ed3d9ecf60cf3895c4bdf0d2a2761d497d8490ecd7767acf20a0b.exe
"C:\Users\Admin\AppData\Local\Temp\6434f68c677ed3d9ecf60cf3895c4bdf0d2a2761d497d8490ecd7767acf20a0b.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Program Files (x86)\9b8995fe\jusched.exe
  "C:\Program Files (x86)\9b8995fe\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\9b8995fe\9b8995fe

Filesize
17B

MD5
4d77d6b250ffb567743b8dbcdad695b8

SHA1
d5a8f98f9433f6d36c74df463cef3e2cf524462d

SHA256
7ec7a3a23890c3592f5b762aecf11adbf8831fad11b8048aedfa7315d599c5f2

SHA512
5655153049101fd67125d484c81f1ad30b44f36f00e3aabfe8d730a21661f4b394357b60da549289def4311b4cc7bd508d8fd6b8db254cd442b2152f8902bd71

Download Submit
\Program Files (x86)\9b8995fe\jusched.exe

Filesize
338KB

MD5
a044033156ac2f0b4228ebb58516923a

SHA1
a61104bb86f8ad1554d2702c0bb2610d94957c4b

SHA256
5b1ad7560b33ec48650f7fbe0260560b94ee7de97950366537d594720f94e518

SHA512
a9908bbf77a41e58b8474cd7be835d5bb15fc72903a2714396eb7ac5ad037b08ce070f925467180a1ad21f6f7b0cb11477bf9f2fcb7b406b1b6ef0b4b87d0e8d

Download Submit
memory/2324-0-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/2324-12-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/2324-7-0x0000000001F20000-0x0000000001F83000-memory.dmp

Filesize
396KB

Download
memory/2916-14-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download