Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 23:44
Static task
static1
Behavioral task
behavioral1
Sample
764d8565eeac3cb947a8809835a02f46c71c8a257c3c511635283e51a2513617.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
764d8565eeac3cb947a8809835a02f46c71c8a257c3c511635283e51a2513617.exe
Resource
win10v2004-20240226-en
General
-
Target
764d8565eeac3cb947a8809835a02f46c71c8a257c3c511635283e51a2513617.exe
-
Size
93KB
-
MD5
1911082266c5156d3229cdbef261f8dc
-
SHA1
11e3ccbe66eee9250c1f35a0a238420e4dd5827d
-
SHA256
764d8565eeac3cb947a8809835a02f46c71c8a257c3c511635283e51a2513617
-
SHA512
ab4f03abb95e2e77c21033c935c14177441d61fc4f38ab3eb0225a25f11ba23ecd8b44f7450612802eef3d664ab08c51bd1daa55637b55f507eabe54a1e5f955
-
SSDEEP
1536:8QTIubHR5wQgAl3YxgUdqiUA6lpW/TvEd/cjEpcuy3Ua0:1Pw/dgU1x6l0Lsco83c
Malware Config
Extracted
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
onthelinux - Password:
741852abc
Signatures
-
Detects executables packed with VMProtect. 1 IoCs
resource yara_rule behavioral1/files/0x00380000000141ab-4.dat INDICATOR_EXE_Packed_VMProtect -
Executes dropped EXE 1 IoCs
pid Process 2192 jusched.exe -
Loads dropped DLL 2 IoCs
pid Process 3016 764d8565eeac3cb947a8809835a02f46c71c8a257c3c511635283e51a2513617.exe 3016 764d8565eeac3cb947a8809835a02f46c71c8a257c3c511635283e51a2513617.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\61dbdd7c\jusched.exe 764d8565eeac3cb947a8809835a02f46c71c8a257c3c511635283e51a2513617.exe File created C:\Program Files (x86)\61dbdd7c\61dbdd7c 764d8565eeac3cb947a8809835a02f46c71c8a257c3c511635283e51a2513617.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe 2192 jusched.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3016 wrote to memory of 2192 3016 764d8565eeac3cb947a8809835a02f46c71c8a257c3c511635283e51a2513617.exe 28 PID 3016 wrote to memory of 2192 3016 764d8565eeac3cb947a8809835a02f46c71c8a257c3c511635283e51a2513617.exe 28 PID 3016 wrote to memory of 2192 3016 764d8565eeac3cb947a8809835a02f46c71c8a257c3c511635283e51a2513617.exe 28 PID 3016 wrote to memory of 2192 3016 764d8565eeac3cb947a8809835a02f46c71c8a257c3c511635283e51a2513617.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\764d8565eeac3cb947a8809835a02f46c71c8a257c3c511635283e51a2513617.exe"C:\Users\Admin\AppData\Local\Temp\764d8565eeac3cb947a8809835a02f46c71c8a257c3c511635283e51a2513617.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Program Files (x86)\61dbdd7c\jusched.exe"C:\Program Files (x86)\61dbdd7c\jusched.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2192
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13B
MD5f253efe302d32ab264a76e0ce65be769
SHA1768685ca582abd0af2fbb57ca37752aa98c9372b
SHA25649dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
SHA5121990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
-
Filesize
93KB
MD58d42123f44bb48cb7f5e3a17074cbb60
SHA16d5de1c5b5395cdec7cad4f184e44e747f258e12
SHA256e3c490bc7b8b7fcb9bb6867ee9731f42d8d6801c9e9a71d8d8c218f2ba9442b8
SHA512245b19de4982220e085851d19c20d52957bfccc5c95bba86c3c8c4f3bdc6500c977cf96e4652d821e4237a7dfb914e0a97e6673aad4d410906a6b96ddd5305c4