250dacb183485710c145fca56b10df0a53488e3e4a2087fcaceb506572db783e

Analysis

max time kernel
122s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01-08-2024 21:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

250dacb183485710c145fca56b10df0a53488e3e4a2087fcaceb506572db783e.exe
Size

509KB
MD5

290e3ac020e970af16f6b9027f7dbdc2
SHA1

10616db84154170aac3ba5069e26eb4f54683dcf
SHA256

250dacb183485710c145fca56b10df0a53488e3e4a2087fcaceb506572db783e
SHA512

6e4a56add0ad2cb9de507c4e033e6ea6a2cf2d2e7d7b287582dd2bcf32b13321298731562a01a12725bdcc14c483b05d2d643e340860e5956c6c41773e5fead9
SSDEEP

3072:jePgCctxGv4QcU9KQ2BBA2waPxstmolzRH+f4VSaPYF8haGjTVtR6:3CctxGsWKQ2Bx5xU3RH+f40i4sPm

Score

10^/10

discovery

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-857544305-989156968-2929034274-1000\Control Panel\International\Geo\Nation	250dacb183485710c145fca56b10df0a53488e3e4a2087fcaceb506572db783e.exe

Executes dropped EXE 1 IoCs

pid	Process
116	jusched.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\93541c20\jusched.exe	250dacb183485710c145fca56b10df0a53488e3e4a2087fcaceb506572db783e.exe
File created	C:\Program Files (x86)\93541c20\93541c20	250dacb183485710c145fca56b10df0a53488e3e4a2087fcaceb506572db783e.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	250dacb183485710c145fca56b10df0a53488e3e4a2087fcaceb506572db783e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	250dacb183485710c145fca56b10df0a53488e3e4a2087fcaceb506572db783e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jusched.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 116	1824	250dacb183485710c145fca56b10df0a53488e3e4a2087fcaceb506572db783e.exe	86
PID 1824 wrote to memory of 116	1824	250dacb183485710c145fca56b10df0a53488e3e4a2087fcaceb506572db783e.exe	86
PID 1824 wrote to memory of 116	1824	250dacb183485710c145fca56b10df0a53488e3e4a2087fcaceb506572db783e.exe	86

C:\Users\Admin\AppData\Local\Temp\250dacb183485710c145fca56b10df0a53488e3e4a2087fcaceb506572db783e.exe
"C:\Users\Admin\AppData\Local\Temp\250dacb183485710c145fca56b10df0a53488e3e4a2087fcaceb506572db783e.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Program Files (x86)\93541c20\jusched.exe
  "C:\Program Files (x86)\93541c20\jusched.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\93541c20\93541c20

Filesize
17B

MD5
552bb86ed2797d3fd12ac0d273afaf75

SHA1
6e8633f9c24590779acbd3dd14c60f856320bc0a

SHA256
3ef9ff5da8272fd1b14c83f12c8d28fd9dbf32d56bcb714921032b02557fe789

SHA512
dab57227de02f4667cc8e2ec47566088b473caa0387caffbdfde37f3400da7d4f67dd222e83a4fa93592694bbcff7c52a2bcec074868baf221bc47d9370c8d2c

Download Submit
C:\Program Files (x86)\93541c20\jusched.exe

Filesize
509KB

MD5
0c561e44c3eec27534daf8dd6bb598c3

SHA1
12f96185da43e802c2da741cc254d3ec24399176

SHA256
acbd2f7e8fc70ac57b442003d076f346660710a11b0ca6204fdab6697b9ad575

SHA512
fdfebb0dd7fbb7d731bc89a11f0a42c0f20be88510e95cc6c6e6805840ec9358b89dfb45abbc0c55948a65ea2b290cd7ccf870eb077846475729c36ee1c014a6

Download Submit
memory/116-13-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/1824-0-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/1824-14-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download