Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/09/2024, 00:10
Static task
static1
Behavioral task
behavioral1
Sample
838fd0952b9a1c39314fe8cd94bf526347600ae8d8b39c078e0ceaaa4e942a1bN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
838fd0952b9a1c39314fe8cd94bf526347600ae8d8b39c078e0ceaaa4e942a1bN.exe
Resource
win10v2004-20240802-en
General
-
Target
838fd0952b9a1c39314fe8cd94bf526347600ae8d8b39c078e0ceaaa4e942a1bN.exe
-
Size
45KB
-
MD5
c42a6a1dc50f8a6cca084699c6d3e370
-
SHA1
701cedbd9d2b3995eb7177c8e731b7048f6c2c93
-
SHA256
838fd0952b9a1c39314fe8cd94bf526347600ae8d8b39c078e0ceaaa4e942a1b
-
SHA512
52cc8c832b1972d8dd74c167eb75974936dc58dd0b4f7ab295f0c1003315d8d59ed71f3b49580612dc86ce357d52a911722e068ce949a76da864756320999735
-
SSDEEP
768:9qSqC8+N5ozQQtncwxWmNXMX3cX8tcXmcX8/XrX8/uU3:9rqfzQQtamN88xjm7c73
Malware Config
Extracted
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
onthelinux - Password:
741852abc
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation 838fd0952b9a1c39314fe8cd94bf526347600ae8d8b39c078e0ceaaa4e942a1bN.exe -
Executes dropped EXE 1 IoCs
pid Process 1516 jusched.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\e4f9239f\jusched.exe 838fd0952b9a1c39314fe8cd94bf526347600ae8d8b39c078e0ceaaa4e942a1bN.exe File created C:\Program Files (x86)\e4f9239f\e4f9239f 838fd0952b9a1c39314fe8cd94bf526347600ae8d8b39c078e0ceaaa4e942a1bN.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 838fd0952b9a1c39314fe8cd94bf526347600ae8d8b39c078e0ceaaa4e942a1bN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe 1516 jusched.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2092 wrote to memory of 1516 2092 838fd0952b9a1c39314fe8cd94bf526347600ae8d8b39c078e0ceaaa4e942a1bN.exe 84 PID 2092 wrote to memory of 1516 2092 838fd0952b9a1c39314fe8cd94bf526347600ae8d8b39c078e0ceaaa4e942a1bN.exe 84 PID 2092 wrote to memory of 1516 2092 838fd0952b9a1c39314fe8cd94bf526347600ae8d8b39c078e0ceaaa4e942a1bN.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\838fd0952b9a1c39314fe8cd94bf526347600ae8d8b39c078e0ceaaa4e942a1bN.exe"C:\Users\Admin\AppData\Local\Temp\838fd0952b9a1c39314fe8cd94bf526347600ae8d8b39c078e0ceaaa4e942a1bN.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Program Files (x86)\e4f9239f\jusched.exe"C:\Program Files (x86)\e4f9239f\jusched.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1516
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13B
MD5f253efe302d32ab264a76e0ce65be769
SHA1768685ca582abd0af2fbb57ca37752aa98c9372b
SHA25649dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
SHA5121990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
-
Filesize
45KB
MD557fca604b181a67102aa7b94e7437848
SHA1bdad3b397ddac5a37cc0457fc1784b316fb88fcb
SHA2561fd5164ace7cc1abe7359913e0d0dbb6fd0e6828896dcda6b21fa7924d50d973
SHA512d16e7d2f69ce2d6a1711fdb82276af04a2e1a0a3b99afc2e5846e87c3ca47010cba787e2a40f88b1c44e30ca4a029b2dc9419ec8612236acc8c30614c5b08d18