aae91b6bd7e8f0e4cdcda00b1c0a91566cd69d51de73532dd1c3ca88d0330b09

Analysis

max time kernel
140s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/04/2024, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

aae91b6bd7e8f0e4cdcda00b1c0a91566cd69d51de73532dd1c3ca88d0330b09.exe
Size

241KB
MD5

0b200044e77a37eda9a59f741be1e13c
SHA1

62cc572946e0a92c0f011263106213fdc9e60188
SHA256

aae91b6bd7e8f0e4cdcda00b1c0a91566cd69d51de73532dd1c3ca88d0330b09
SHA512

17f08739e6d85e32c7c8d6571d1f06316573a97809e87c7981e8e50444b921828f339533d6e9cbf25dbb910fb30b8147b8baba475f87065845fa1c31624ffbde
SSDEEP

1536:PXs9wrnUh4d7ygVpn0uv77P11gqu87qhofg/dBWpb:PXYw4+dGgLn0sP11gqGofg1C

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.alizametal.com.tr
Port:
21
Username:
alizametal.com.tr
Password:
hd611

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	aae91b6bd7e8f0e4cdcda00b1c0a91566cd69d51de73532dd1c3ca88d0330b09.exe

Executes dropped EXE 1 IoCs

pid	Process
1604	jusched.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ef57e45a\ef57e45a	aae91b6bd7e8f0e4cdcda00b1c0a91566cd69d51de73532dd1c3ca88d0330b09.exe
File created	C:\Program Files (x86)\ef57e45a\info_a	aae91b6bd7e8f0e4cdcda00b1c0a91566cd69d51de73532dd1c3ca88d0330b09.exe
File created	C:\Program Files (x86)\ef57e45a\jusched.exe	aae91b6bd7e8f0e4cdcda00b1c0a91566cd69d51de73532dd1c3ca88d0330b09.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	aae91b6bd7e8f0e4cdcda00b1c0a91566cd69d51de73532dd1c3ca88d0330b09.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 1604	4656	aae91b6bd7e8f0e4cdcda00b1c0a91566cd69d51de73532dd1c3ca88d0330b09.exe	94
PID 4656 wrote to memory of 1604	4656	aae91b6bd7e8f0e4cdcda00b1c0a91566cd69d51de73532dd1c3ca88d0330b09.exe	94
PID 4656 wrote to memory of 1604	4656	aae91b6bd7e8f0e4cdcda00b1c0a91566cd69d51de73532dd1c3ca88d0330b09.exe	94

C:\Users\Admin\AppData\Local\Temp\aae91b6bd7e8f0e4cdcda00b1c0a91566cd69d51de73532dd1c3ca88d0330b09.exe
"C:\Users\Admin\AppData\Local\Temp\aae91b6bd7e8f0e4cdcda00b1c0a91566cd69d51de73532dd1c3ca88d0330b09.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Program Files (x86)\ef57e45a\jusched.exe
  "C:\Program Files (x86)\ef57e45a\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:1604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3880 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:3952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\ef57e45a\ef57e45a

Filesize
17B

MD5
6ff89798e0e63d75115c777af43a2cd9

SHA1
e8b994ccbbe64951afe91fc3dd377f88fe6c9ba8

SHA256
3b3947957c6e0abb19d91b256521bdb3826d88d9b7b53995e177a58cebf0d479

SHA512
46557f9bf6f5c5b3316891a9b623a7d11d8d8ff1973ca84cfbcf8d898746f2dbded7fee837c9a70c2e36f9b46a357fe2ba53585bf5307950d2fef6ee1dcb28a3

Download Submit
C:\Program Files (x86)\ef57e45a\info_a

Filesize
12B

MD5
16d4c4918e42377af0b2b02896f46180

SHA1
445b860e13dca5b465e15bcc79d5a768bf42aa8b

SHA256
44e68bd741726e991539e0b1235f2265d1d96532053662a3574310eb58169155

SHA512
7a6ae40b0b6ab6a13c33db9d0f41cd339fae3ce8bc6d0705cef8941e1087868c0bcad2e8c26f51793e5796d471ffb75729808351cf1d8178dad50de326e3717c

Download Submit
C:\Program Files (x86)\ef57e45a\jusched.exe

Filesize
241KB

MD5
4c62caa26a723dde733019380054b949

SHA1
8cdf42a3643249fd9c5fac785cd499d850c0c1d9

SHA256
84becf68f1317f4a7222a4ff7f4acb91d0cf549eaceebe2a9022513bd92a85d1

SHA512
2c6959381d9b454d819e7649d55333c086b792c1cc1336bb43df77f9f8bb6ed4168348c4f44b3518d6126a61534f34ec0c89378394e2e4da71761f5f4ef22469

Download Submit
memory/1604-15-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/4656-0-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/4656-16-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download