b26eccd66fbfdbc009f5e36766edc1783ae5ea5ac09da2f21c03719c88c3b458

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 17:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b26eccd66fbfdbc009f5e36766edc1783ae5ea5ac09da2f21c03719c88c3b458N.exe
Size

302KB
MD5

4be45e313eef82ec869890e47f837a00
SHA1

c7bf2211256f4988efc95cfd4e93b874769b16bf
SHA256

b26eccd66fbfdbc009f5e36766edc1783ae5ea5ac09da2f21c03719c88c3b458
SHA512

d703d06fc325c6299bf1489e99e1f25bcb97a152e6e66f20dd1c9826c5f1bb74699367b6691511e74f0bdfb6dccbe8cb383d897c6c2e04ea8f129ddc8f70cef7
SSDEEP

3072:5BlvaWjzrLXQQJKgmSBAVpet2AgoulWXA:DpaWjz/gGKgmS+k2zWQ

Score

10^/10

discovery

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1984	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
756	b26eccd66fbfdbc009f5e36766edc1783ae5ea5ac09da2f21c03719c88c3b458N.exe
756	b26eccd66fbfdbc009f5e36766edc1783ae5ea5ac09da2f21c03719c88c3b458N.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\2d8192ea\jusched.exe	b26eccd66fbfdbc009f5e36766edc1783ae5ea5ac09da2f21c03719c88c3b458N.exe
File created	C:\Program Files (x86)\2d8192ea\2d8192ea	b26eccd66fbfdbc009f5e36766edc1783ae5ea5ac09da2f21c03719c88c3b458N.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	b26eccd66fbfdbc009f5e36766edc1783ae5ea5ac09da2f21c03719c88c3b458N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b26eccd66fbfdbc009f5e36766edc1783ae5ea5ac09da2f21c03719c88c3b458N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jusched.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 1984	756	b26eccd66fbfdbc009f5e36766edc1783ae5ea5ac09da2f21c03719c88c3b458N.exe	28
PID 756 wrote to memory of 1984	756	b26eccd66fbfdbc009f5e36766edc1783ae5ea5ac09da2f21c03719c88c3b458N.exe	28
PID 756 wrote to memory of 1984	756	b26eccd66fbfdbc009f5e36766edc1783ae5ea5ac09da2f21c03719c88c3b458N.exe	28
PID 756 wrote to memory of 1984	756	b26eccd66fbfdbc009f5e36766edc1783ae5ea5ac09da2f21c03719c88c3b458N.exe	28

C:\Users\Admin\AppData\Local\Temp\b26eccd66fbfdbc009f5e36766edc1783ae5ea5ac09da2f21c03719c88c3b458N.exe
"C:\Users\Admin\AppData\Local\Temp\b26eccd66fbfdbc009f5e36766edc1783ae5ea5ac09da2f21c03719c88c3b458N.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:756
- C:\Program Files (x86)\2d8192ea\jusched.exe
  "C:\Program Files (x86)\2d8192ea\jusched.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\2d8192ea\2d8192ea

Filesize
17B

MD5
2130fee70fc3f7c10d5279f96f98ad1e

SHA1
4307cef89171fa230048ea22546802198d888780

SHA256
3506e286f6223ccaf1665d4e457b712abeb527266ff28327ce60e37b9fbeb404

SHA512
67fa1bb31028ff3ba125f184207499b9205f58c9eef2ac948f5824475515c396b3d5f93e207cb96deffe1aedb286b1f935cc689c5d84449e51c517da1cffe2e5

Download Submit
\Program Files (x86)\2d8192ea\jusched.exe

Filesize
302KB

MD5
4abec29ccd7b9187bd24c5ea46a098af

SHA1
abcb6980141111bcf600a4bfe472ffbb79c4dcf3

SHA256
8c8ca23d62b914a7b4806ebcc55e08928e916133eaee4faedd8ec528ec3512b2

SHA512
043eff37bd6a3b5f0b15c8fce97b3b7cfcbdf0467d676f9d8f9e62382b8f7eab479ce6529a3697cd589c438c91ecb08475f81520ae89d48a55b5fcff7495f28b

Download Submit
memory/756-0-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/756-7-0x0000000002950000-0x00000000029A9000-memory.dmp

Filesize
356KB

Download
memory/756-13-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1984-15-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download