250dacb183485710c145fca56b10df0a53488e3e4a2087fcaceb506572db783e

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01-08-2024 21:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

250dacb183485710c145fca56b10df0a53488e3e4a2087fcaceb506572db783e.exe
Size

509KB
MD5

290e3ac020e970af16f6b9027f7dbdc2
SHA1

10616db84154170aac3ba5069e26eb4f54683dcf
SHA256

250dacb183485710c145fca56b10df0a53488e3e4a2087fcaceb506572db783e
SHA512

6e4a56add0ad2cb9de507c4e033e6ea6a2cf2d2e7d7b287582dd2bcf32b13321298731562a01a12725bdcc14c483b05d2d643e340860e5956c6c41773e5fead9
SSDEEP

3072:jePgCctxGv4QcU9KQ2BBA2waPxstmolzRH+f4VSaPYF8haGjTVtR6:3CctxGsWKQ2Bx5xU3RH+f40i4sPm

Score

10^/10

discovery

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Signatures

Executes dropped EXE 1 IoCs

pid	Process
296	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
2360	250dacb183485710c145fca56b10df0a53488e3e4a2087fcaceb506572db783e.exe
2360	250dacb183485710c145fca56b10df0a53488e3e4a2087fcaceb506572db783e.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\6c9fc69e\jusched.exe	250dacb183485710c145fca56b10df0a53488e3e4a2087fcaceb506572db783e.exe
File created	C:\Program Files (x86)\6c9fc69e\6c9fc69e	250dacb183485710c145fca56b10df0a53488e3e4a2087fcaceb506572db783e.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	250dacb183485710c145fca56b10df0a53488e3e4a2087fcaceb506572db783e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	250dacb183485710c145fca56b10df0a53488e3e4a2087fcaceb506572db783e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jusched.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 296	2360	250dacb183485710c145fca56b10df0a53488e3e4a2087fcaceb506572db783e.exe	30
PID 2360 wrote to memory of 296	2360	250dacb183485710c145fca56b10df0a53488e3e4a2087fcaceb506572db783e.exe	30
PID 2360 wrote to memory of 296	2360	250dacb183485710c145fca56b10df0a53488e3e4a2087fcaceb506572db783e.exe	30
PID 2360 wrote to memory of 296	2360	250dacb183485710c145fca56b10df0a53488e3e4a2087fcaceb506572db783e.exe	30

C:\Users\Admin\AppData\Local\Temp\250dacb183485710c145fca56b10df0a53488e3e4a2087fcaceb506572db783e.exe
"C:\Users\Admin\AppData\Local\Temp\250dacb183485710c145fca56b10df0a53488e3e4a2087fcaceb506572db783e.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Program Files (x86)\6c9fc69e\jusched.exe
  "C:\Program Files (x86)\6c9fc69e\jusched.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\6c9fc69e\6c9fc69e

Filesize
17B

MD5
552bb86ed2797d3fd12ac0d273afaf75

SHA1
6e8633f9c24590779acbd3dd14c60f856320bc0a

SHA256
3ef9ff5da8272fd1b14c83f12c8d28fd9dbf32d56bcb714921032b02557fe789

SHA512
dab57227de02f4667cc8e2ec47566088b473caa0387caffbdfde37f3400da7d4f67dd222e83a4fa93592694bbcff7c52a2bcec074868baf221bc47d9370c8d2c

Download Submit
\Program Files (x86)\6c9fc69e\jusched.exe

Filesize
509KB

MD5
6b6655e88d33d410cb165d4d1386eb2b

SHA1
643b1a138fead18975354914a37dc5c1dd3c7ff7

SHA256
c5a963d111d59edb11b4482ecdcde1a63045a3c6bc3d511f455d077a6491feec

SHA512
693f31395a18258fa236ffb4225a483dc7702c4e058d4885bbb0a94d8f3e07e7a250f2f9468da0bca9551bdf92dab1e1a969e62ef32c6bc472c4049e90ec1c37

Download Submit
memory/296-14-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/2360-0-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/2360-7-0x0000000002950000-0x00000000029DF000-memory.dmp

Filesize
572KB

Download
memory/2360-12-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download