Analysis
- max time kernel
149s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
10/06/2024, 03:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
254530c44de4d7b9c164233c3bc9f5e3d023c50af081ae229d2724e5dd95343e.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
254530c44de4d7b9c164233c3bc9f5e3d023c50af081ae229d2724e5dd95343e.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 254530c44de4d7b9c164233c3bc9f5e3d023c50af081ae229d2724e5dd95343e.exe
- Size 45KB
- Sample240610-ee9m6acd27
- SHA256 254530c44de4d7b9c164233c3bc9f5e3d023c50af081ae229d2724e5dd95343e
- MD5 6d681dd44b40c6eaa5b50ea15c2eb3de
- SHA1 c0d6d292d81bca20868689115884f1768ff95817
- SHA512 d140821a99b1ffd085019e7b8ff2761330aed103aad73a5f39fc8f17a54f306e362d27bd331c4967107db50a0992cd7aae2ac8438343d43a280efe6e86c9ad1d
- SSDEEP 768:kflivXrVKpVhKvtxwYHwVFoeAQXmucwUKzdlPPKa:alqrVKprVuQX7z7Pn
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Credentials
-
Protocol
ftp
-
Host
ftp.tripod.com
-
Port
21
-
Username
onthelinux
-
Password
741852abc
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 254530c44de4d7b9c164233c3bc9f5e3d023c50af081ae229d2724e5dd95343e.exe - Executes dropped EXE 1 IoCs
pid Process 892 jusched.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\d63ab9bc\jusched.exe 254530c44de4d7b9c164233c3bc9f5e3d023c50af081ae229d2724e5dd95343e.exe File created C:\Program Files (x86)\d63ab9bc\d63ab9bc 254530c44de4d7b9c164233c3bc9f5e3d023c50af081ae229d2724e5dd95343e.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe 892 jusched.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 852 wrote to memory of 892 852 254530c44de4d7b9c164233c3bc9f5e3d023c50af081ae229d2724e5dd95343e.exe 88 PID 852 wrote to memory of 892 852 254530c44de4d7b9c164233c3bc9f5e3d023c50af081ae229d2724e5dd95343e.exe 88 PID 852 wrote to memory of 892 852 254530c44de4d7b9c164233c3bc9f5e3d023c50af081ae229d2724e5dd95343e.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\254530c44de4d7b9c164233c3bc9f5e3d023c50af081ae229d2724e5dd95343e.exe"C:\Users\Admin\AppData\Local\Temp\254530c44de4d7b9c164233c3bc9f5e3d023c50af081ae229d2724e5dd95343e.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Program Files (x86)\d63ab9bc\jusched.exe"C:\Program Files (x86)\d63ab9bc\jusched.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:892
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\d63ab9bc\d63ab9bc
- Size 13B
- SHA256 49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
- MD5 f253efe302d32ab264a76e0ce65be769
- SHA1 768685ca582abd0af2fbb57ca37752aa98c9372b
- SHA512 1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\d63ab9bc\jusched.exe
- Size 45KB
- SHA256 e1cf05c7f7f34953485aa45b18e3b3cdf5aaed48f312968ecdf9c7127973a358
- MD5 22838b6f68c549481a1fa6b3d9746fc9
- SHA1 24e3a35fe7d31e5aeb29a0bd6ffb7f66f2f2df2a
- SHA512 1b49fd67de2915b824065596a8db1dbd95d1b5b026b45d98f4c5c47d3f7145053ca9db7b86f5ba7ba1cd4feee29b6a5b1527b93acf815ba21cc198ef557070c9
- SSDEEP 768:kflivXrVKpVhKvtxwYHwVFoeAQumucwUKzdlPPK2:alqrVKprVuQu7z7Pn
- MD5 SHA1 SHA512 SSDEEP