6434f68c677ed3d9ecf60cf3895c4bdf0d2a2761d497d8490ecd7767acf20a0b

Analysis

max time kernel
146s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2024, 22:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6434f68c677ed3d9ecf60cf3895c4bdf0d2a2761d497d8490ecd7767acf20a0b.exe
Size

338KB
MD5

bdcb97c4b014c370560571f3c4e101ae
SHA1

23c25b0f8b17a11f7a686b4af4f8e071ebc78b83
SHA256

6434f68c677ed3d9ecf60cf3895c4bdf0d2a2761d497d8490ecd7767acf20a0b
SHA512

aa93e174ed7b226dcb9aae7f8e36de3cf3a2f0b5fe6c652e02e49d338dd108a7abe4ea9789092cb4731c02d5563eca1ead49f1eb0c7d1faddceb6b84fff83b87
SSDEEP

3072:N53mQ7JtnP5I09qgmBBAWgjSvwx/o0WBAYEQ3/AeohItgs6CFtIaxv8gD8Lll0Qo:bmKJtna2qgmBNgQwwAw/SItgtwt0p5bM

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation	6434f68c677ed3d9ecf60cf3895c4bdf0d2a2761d497d8490ecd7767acf20a0b.exe

Executes dropped EXE 1 IoCs

pid	Process
4164	jusched.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\4858b905\jusched.exe	6434f68c677ed3d9ecf60cf3895c4bdf0d2a2761d497d8490ecd7767acf20a0b.exe
File created	C:\Program Files (x86)\4858b905\4858b905	6434f68c677ed3d9ecf60cf3895c4bdf0d2a2761d497d8490ecd7767acf20a0b.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	6434f68c677ed3d9ecf60cf3895c4bdf0d2a2761d497d8490ecd7767acf20a0b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 4164	2864	6434f68c677ed3d9ecf60cf3895c4bdf0d2a2761d497d8490ecd7767acf20a0b.exe	93
PID 2864 wrote to memory of 4164	2864	6434f68c677ed3d9ecf60cf3895c4bdf0d2a2761d497d8490ecd7767acf20a0b.exe	93
PID 2864 wrote to memory of 4164	2864	6434f68c677ed3d9ecf60cf3895c4bdf0d2a2761d497d8490ecd7767acf20a0b.exe	93

C:\Users\Admin\AppData\Local\Temp\6434f68c677ed3d9ecf60cf3895c4bdf0d2a2761d497d8490ecd7767acf20a0b.exe
"C:\Users\Admin\AppData\Local\Temp\6434f68c677ed3d9ecf60cf3895c4bdf0d2a2761d497d8490ecd7767acf20a0b.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Program Files (x86)\4858b905\jusched.exe
  "C:\Program Files (x86)\4858b905\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:4164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\4858b905\4858b905

Filesize
17B

MD5
4d77d6b250ffb567743b8dbcdad695b8

SHA1
d5a8f98f9433f6d36c74df463cef3e2cf524462d

SHA256
7ec7a3a23890c3592f5b762aecf11adbf8831fad11b8048aedfa7315d599c5f2

SHA512
5655153049101fd67125d484c81f1ad30b44f36f00e3aabfe8d730a21661f4b394357b60da549289def4311b4cc7bd508d8fd6b8db254cd442b2152f8902bd71

Download Submit
C:\Program Files (x86)\4858b905\jusched.exe

Filesize
338KB

MD5
67c0e27a3a61b3aab7a9a6286bd679bb

SHA1
93d14910b7a76c3ed8e341e3346b0e681c649108

SHA256
a2d5de6888802711cfb91f99bf82761f4e74ca97c2de79f7a2cbf15526d510fa

SHA512
681812e0d46114372acda859081fddfc39c6e1c229ebefdad5ccaa4033bcafcf3ed1fa02a560453b664ff880d34fd0b7d7117d21cd39f9154cfb8475da287a04

Download Submit
memory/2864-0-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/2864-14-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/4164-15-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download