437aa5ad2eeecbb9eebf95d76d529eb248b532a6c8e0e60fe3b92bd0c89015fa

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 21:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

437aa5ad2eeecbb9eebf95d76d529eb248b532a6c8e0e60fe3b92bd0c89015fa.exe
Size

59KB
MD5

b2fbf7dbd3bbb3dc4323a88c3cd90093
SHA1

d49a8b4e52f8911d745ff4b7676e19d713464087
SHA256

437aa5ad2eeecbb9eebf95d76d529eb248b532a6c8e0e60fe3b92bd0c89015fa
SHA512

bbd8e0bdffd32134aa679ce7c1863ae3bf91f47b5f3476daf22d03010c153694cef5445dc00c96cead763ad666392bd5810eb5661ca3ef8dd326dadf85e2ed2f
SSDEEP

768:9qSqC8+N5ozQQkncwxWmNXMX3cX8wtgtzpAXpX8/X/7CUrfbtSqklPUV:9rqfzQQkamN8835mv7CUroqklPC

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2072	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
2172	437aa5ad2eeecbb9eebf95d76d529eb248b532a6c8e0e60fe3b92bd0c89015fa.exe
2172	437aa5ad2eeecbb9eebf95d76d529eb248b532a6c8e0e60fe3b92bd0c89015fa.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\efe79842\jusched.exe	437aa5ad2eeecbb9eebf95d76d529eb248b532a6c8e0e60fe3b92bd0c89015fa.exe
File created	C:\Program Files (x86)\efe79842\efe79842	437aa5ad2eeecbb9eebf95d76d529eb248b532a6c8e0e60fe3b92bd0c89015fa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe
2072	jusched.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2072	2172	437aa5ad2eeecbb9eebf95d76d529eb248b532a6c8e0e60fe3b92bd0c89015fa.exe	28
PID 2172 wrote to memory of 2072	2172	437aa5ad2eeecbb9eebf95d76d529eb248b532a6c8e0e60fe3b92bd0c89015fa.exe	28
PID 2172 wrote to memory of 2072	2172	437aa5ad2eeecbb9eebf95d76d529eb248b532a6c8e0e60fe3b92bd0c89015fa.exe	28
PID 2172 wrote to memory of 2072	2172	437aa5ad2eeecbb9eebf95d76d529eb248b532a6c8e0e60fe3b92bd0c89015fa.exe	28

C:\Users\Admin\AppData\Local\Temp\437aa5ad2eeecbb9eebf95d76d529eb248b532a6c8e0e60fe3b92bd0c89015fa.exe
"C:\Users\Admin\AppData\Local\Temp\437aa5ad2eeecbb9eebf95d76d529eb248b532a6c8e0e60fe3b92bd0c89015fa.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\efe79842\jusched.exe
  "C:\Program Files (x86)\efe79842\jusched.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\efe79842\efe79842

Filesize
13B

MD5
f253efe302d32ab264a76e0ce65be769

SHA1
768685ca582abd0af2fbb57ca37752aa98c9372b

SHA256
49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd

SHA512
1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4

Download Submit
\Program Files (x86)\efe79842\jusched.exe

Filesize
59KB

MD5
367da4c30e77bd271637944ac3392d98

SHA1
feb57bf0fbcb2dc1052bf582fa525228ee961003

SHA256
bb77bf7862fdc4110e49d5858a897aec719b345aef21cf0541ea2b22212df449

SHA512
599c2014e68f451f7a992a41bcb69f8fdf90f8d2de69b7273326fb41f0e8bc082c8202823d67beb6aebe484b6a28cb4697f1731d2f3f9bf5e9f5f7df84230cea

Download Submit
memory/2072-17-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2072-20-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2172-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2172-5-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2172-4-0x0000000000401000-0x0000000000406000-memory.dmp

Filesize
20KB

Download
memory/2172-3-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2172-16-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download