Analysis
-
max time kernel
119s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20/08/2024, 09:49
Static task
static1
Behavioral task
behavioral1
Sample
caf55e8b0e9c865a45101cf7331ffd60N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
caf55e8b0e9c865a45101cf7331ffd60N.exe
Resource
win10v2004-20240802-en
General
-
Target
caf55e8b0e9c865a45101cf7331ffd60N.exe
-
Size
61KB
-
MD5
caf55e8b0e9c865a45101cf7331ffd60
-
SHA1
a9a7666c829103d8668ff2811213d444e1bcfe4a
-
SHA256
3b10cb7d04670ff32b719bc74ff881634c66af03be6ae43f349ee2e5d00f2777
-
SHA512
eb654543f6690f5b28d29dabebcf02e943ae90a8b97c33fa74138f816570fab31ed9e26767dd461665c13d96ceb15b7db7a56cf535e058d8bfed36263d398e2b
-
SSDEEP
768:6zQYScGrIubHuYtv0xwYHw5FAe2Q2ncwx8Nwv92g3iVS77DeJRe:8QTIubHR5wQ2Ac3iVS77me
Malware Config
Extracted
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
onthelinux - Password:
741852abc
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation caf55e8b0e9c865a45101cf7331ffd60N.exe -
Executes dropped EXE 1 IoCs
pid Process 2940 jusched.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\660d572e\jusched.exe caf55e8b0e9c865a45101cf7331ffd60N.exe File created C:\Program Files (x86)\660d572e\660d572e caf55e8b0e9c865a45101cf7331ffd60N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language caf55e8b0e9c865a45101cf7331ffd60N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe 2940 jusched.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3636 wrote to memory of 2940 3636 caf55e8b0e9c865a45101cf7331ffd60N.exe 90 PID 3636 wrote to memory of 2940 3636 caf55e8b0e9c865a45101cf7331ffd60N.exe 90 PID 3636 wrote to memory of 2940 3636 caf55e8b0e9c865a45101cf7331ffd60N.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\caf55e8b0e9c865a45101cf7331ffd60N.exe"C:\Users\Admin\AppData\Local\Temp\caf55e8b0e9c865a45101cf7331ffd60N.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Program Files (x86)\660d572e\jusched.exe"C:\Program Files (x86)\660d572e\jusched.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2940
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13B
MD5f253efe302d32ab264a76e0ce65be769
SHA1768685ca582abd0af2fbb57ca37752aa98c9372b
SHA25649dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
SHA5121990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
-
Filesize
61KB
MD52c205368fa7c6755da61132296197b40
SHA1e7beff5b7b79753c28c0c139ec71e668103e9b00
SHA2561b29f7f26b61b5bd43a817fa7c5fa8a59c1eea90b8e457d8c9b58a01abcd389f
SHA5128eaa8bbe0342cc39a8575f80dd14ace77c015498f1d60f5e2ba67ba943cb5aea79502c0d056e182459710c54f0216374592d919962f83cb6fc9e69837b1d1218