a0ebac1fa7079ea847edd32ab787eabeca78ef952da6d7ee52abe33e8c812318

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-09-2024 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0ebac1fa7079ea847edd32ab787eabeca78ef952da6d7ee52abe33e8c812318N.exe
Size

231KB
MD5

9d8abefe3d23bec56e27e0c415811b30
SHA1

45c144797428e839b25120ef823422fab1d2fa46
SHA256

a0ebac1fa7079ea847edd32ab787eabeca78ef952da6d7ee52abe33e8c812318
SHA512

02680d4c5a31d1cc9de8aff88945f3d43ca30dd022e6fb24c4e3386d3c1a6d397a926e84424d791c5fe10b31c5e2240439df9b69aaaced928cdebf52c93a9d6d
SSDEEP

1536:SvVQb4cLIkN+4Weat2RKLjWlC48Pp9JAcj6SrowK3pAzxqLXq:SvVQLIkLWeaA8KlCph97rowK3pU6Xq

Score

10^/10

discovery

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3048	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
2328	a0ebac1fa7079ea847edd32ab787eabeca78ef952da6d7ee52abe33e8c812318N.exe
2328	a0ebac1fa7079ea847edd32ab787eabeca78ef952da6d7ee52abe33e8c812318N.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\23d3dc47\jusched.exe	a0ebac1fa7079ea847edd32ab787eabeca78ef952da6d7ee52abe33e8c812318N.exe
File created	C:\Program Files (x86)\23d3dc47\23d3dc47	a0ebac1fa7079ea847edd32ab787eabeca78ef952da6d7ee52abe33e8c812318N.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	a0ebac1fa7079ea847edd32ab787eabeca78ef952da6d7ee52abe33e8c812318N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a0ebac1fa7079ea847edd32ab787eabeca78ef952da6d7ee52abe33e8c812318N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jusched.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 3048	2328	a0ebac1fa7079ea847edd32ab787eabeca78ef952da6d7ee52abe33e8c812318N.exe	31
PID 2328 wrote to memory of 3048	2328	a0ebac1fa7079ea847edd32ab787eabeca78ef952da6d7ee52abe33e8c812318N.exe	31
PID 2328 wrote to memory of 3048	2328	a0ebac1fa7079ea847edd32ab787eabeca78ef952da6d7ee52abe33e8c812318N.exe	31
PID 2328 wrote to memory of 3048	2328	a0ebac1fa7079ea847edd32ab787eabeca78ef952da6d7ee52abe33e8c812318N.exe	31

C:\Users\Admin\AppData\Local\Temp\a0ebac1fa7079ea847edd32ab787eabeca78ef952da6d7ee52abe33e8c812318N.exe
"C:\Users\Admin\AppData\Local\Temp\a0ebac1fa7079ea847edd32ab787eabeca78ef952da6d7ee52abe33e8c812318N.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Program Files (x86)\23d3dc47\jusched.exe
  "C:\Program Files (x86)\23d3dc47\jusched.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\23d3dc47\23d3dc47

Filesize
17B

MD5
7bdf61d37c9adf3e1c6937107016091f

SHA1
56b8e0c454f9dd16d508a04b3afa7e458453ac41

SHA256
4c57d86c256214baa0a5a3322ef5cdd575210455b7e964ad60382bd9d4be12e0

SHA512
ff4fc1a427c84f47042375749f45ee6edea73b902ae977f14243ebceb7b9a28f41fe5dd404e3ea381754d9122202bc6b61ed0152b20a1c1be76c225dd20861d1

Download Submit
\Program Files (x86)\23d3dc47\jusched.exe

Filesize
231KB

MD5
1fc6283ea0837892eef7afd3c7cc23d7

SHA1
a1eff532749f3ddc2cfc369e5dd2d97bbc1e5fe6

SHA256
25d4b8074c71420aa947ffc7b060452a34a47ed9a96b02b8f24940f9af88896d

SHA512
ea06a2d7cc1d177c5f26f34f656c5213deb99f89963e7f4d910c986d48d3b97c549ecc90800108bf93073666a58074d17c18f7c43173cb9a13c98fd151131579

Download Submit
memory/2328-0-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2328-7-0x0000000002A70000-0x0000000002ABE000-memory.dmp

Filesize
312KB

Download
memory/2328-13-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2328-12-0x0000000002A70000-0x0000000002ABE000-memory.dmp

Filesize
312KB

Download
memory/3048-15-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download