aae91b6bd7e8f0e4cdcda00b1c0a91566cd69d51de73532dd1c3ca88d0330b09

Analysis

max time kernel
140s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/04/2024, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

aae91b6bd7e8f0e4cdcda00b1c0a91566cd69d51de73532dd1c3ca88d0330b09.exe
Size

241KB
MD5

0b200044e77a37eda9a59f741be1e13c
SHA1

62cc572946e0a92c0f011263106213fdc9e60188
SHA256

aae91b6bd7e8f0e4cdcda00b1c0a91566cd69d51de73532dd1c3ca88d0330b09
SHA512

17f08739e6d85e32c7c8d6571d1f06316573a97809e87c7981e8e50444b921828f339533d6e9cbf25dbb910fb30b8147b8baba475f87065845fa1c31624ffbde
SSDEEP

1536:PXs9wrnUh4d7ygVpn0uv77P11gqu87qhofg/dBWpb:PXYw4+dGgLn0sP11gqGofg1C

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.alizametal.com.tr
Port:
21
Username:
alizametal.com.tr
Password:
hd611

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2240	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
2292	aae91b6bd7e8f0e4cdcda00b1c0a91566cd69d51de73532dd1c3ca88d0330b09.exe
2292	aae91b6bd7e8f0e4cdcda00b1c0a91566cd69d51de73532dd1c3ca88d0330b09.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\8df0f6e1\jusched.exe	aae91b6bd7e8f0e4cdcda00b1c0a91566cd69d51de73532dd1c3ca88d0330b09.exe
File created	C:\Program Files (x86)\8df0f6e1\8df0f6e1	aae91b6bd7e8f0e4cdcda00b1c0a91566cd69d51de73532dd1c3ca88d0330b09.exe
File created	C:\Program Files (x86)\8df0f6e1\info_a	aae91b6bd7e8f0e4cdcda00b1c0a91566cd69d51de73532dd1c3ca88d0330b09.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	aae91b6bd7e8f0e4cdcda00b1c0a91566cd69d51de73532dd1c3ca88d0330b09.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2240	2292	aae91b6bd7e8f0e4cdcda00b1c0a91566cd69d51de73532dd1c3ca88d0330b09.exe	28
PID 2292 wrote to memory of 2240	2292	aae91b6bd7e8f0e4cdcda00b1c0a91566cd69d51de73532dd1c3ca88d0330b09.exe	28
PID 2292 wrote to memory of 2240	2292	aae91b6bd7e8f0e4cdcda00b1c0a91566cd69d51de73532dd1c3ca88d0330b09.exe	28
PID 2292 wrote to memory of 2240	2292	aae91b6bd7e8f0e4cdcda00b1c0a91566cd69d51de73532dd1c3ca88d0330b09.exe	28

C:\Users\Admin\AppData\Local\Temp\aae91b6bd7e8f0e4cdcda00b1c0a91566cd69d51de73532dd1c3ca88d0330b09.exe
"C:\Users\Admin\AppData\Local\Temp\aae91b6bd7e8f0e4cdcda00b1c0a91566cd69d51de73532dd1c3ca88d0330b09.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Program Files (x86)\8df0f6e1\jusched.exe
  "C:\Program Files (x86)\8df0f6e1\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\8df0f6e1\8df0f6e1

Filesize
17B

MD5
6ff89798e0e63d75115c777af43a2cd9

SHA1
e8b994ccbbe64951afe91fc3dd377f88fe6c9ba8

SHA256
3b3947957c6e0abb19d91b256521bdb3826d88d9b7b53995e177a58cebf0d479

SHA512
46557f9bf6f5c5b3316891a9b623a7d11d8d8ff1973ca84cfbcf8d898746f2dbded7fee837c9a70c2e36f9b46a357fe2ba53585bf5307950d2fef6ee1dcb28a3

Download Submit
C:\Program Files (x86)\8df0f6e1\info_a

Filesize
12B

MD5
16d4c4918e42377af0b2b02896f46180

SHA1
445b860e13dca5b465e15bcc79d5a768bf42aa8b

SHA256
44e68bd741726e991539e0b1235f2265d1d96532053662a3574310eb58169155

SHA512
7a6ae40b0b6ab6a13c33db9d0f41cd339fae3ce8bc6d0705cef8941e1087868c0bcad2e8c26f51793e5796d471ffb75729808351cf1d8178dad50de326e3717c

Download Submit
\Program Files (x86)\8df0f6e1\jusched.exe

Filesize
241KB

MD5
16a077eb3a75532897e871c280b160a5

SHA1
54d31c801fee19dc0bed90d31de21002a84af772

SHA256
39491fdb5b5fe3419c149c272b804e2a3637deaf0f51d1548969f76196430801

SHA512
c87de8db06bbd184e726380b61b7409dc80f0f8e18c99edf8e444b911455f348f0888d563fac0edd6c0c6e9cb55e267c681583f8c53e17b42a5ddc6218c57f12

Download Submit
memory/2240-15-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2292-0-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2292-13-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2292-8-0x00000000026A0000-0x00000000026FE000-memory.dmp

Filesize
376KB

Download