Analysis
-
max time kernel
80s -
max time network
80s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
07-10-2024 10:43
General
-
Target
$R9/Plugins/tftp.exe
-
Size
95KB
-
MD5
461ed9a62b59cf0436ab6cee3c60fe85
-
SHA1
3f41a2796cc993a1d2196d1973f2cd1990a8c505
-
SHA256
40fe74d3a1116ed8ca64c62feb694327a414059eeaef62c28bc5917e2e991b3d
-
SHA512
5f6f7528a05175cc1b8d927feaba56a90c70e8fe42c7ea01999cf328d28b8596de0df8d6d3fbc6e4fe5d89e36982871a59493dcb8d633fb942a35a217e4aedef
-
SSDEEP
1536:TZUlmkDwItbItNwDXIGE5IzBDMDaoQBMJrGIZUn7:9ULDBBIoXvOqBBAUn7
Score
10/10
Malware Config
Extracted
Credentials
Protocol: ftp- Host:
176.124.138.1 - Port:
21 - Username:
ftp
Extracted
Credentials
Protocol: ftp- Host:
13.69.9.3 - Port:
21 - Username:
user - Password:
cisco
Signatures
-
Contacts a large (538) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\$R9\Plugins\tftp.exe"C:\Users\Admin\AppData\Local\Temp\$R9\Plugins\tftp.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB