Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31-10-2024 08:25
Static task
static1
Behavioral task
behavioral1
Sample
18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495N.exe
Resource
win10v2004-20241007-en
General
-
Target
18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495N.exe
-
Size
244KB
-
MD5
7772dd776f6f1dd6c4606d22a3a81170
-
SHA1
872d64d114b9c32d17b707ac6babd9af58602a45
-
SHA256
18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495
-
SHA512
fb39bfa63761bcc3231e51f0174d3ab4912ae326463f6071d8438035ab41cafde3b697ae803ffa67bd3fb56fa985c325cd10511d02aec9e7bd33e6213cf5483e
-
SSDEEP
1536:dvVte+7YkayZ+OttmxKLjWlSA8Zp5JAJjkrSHoW8MHCCSdCes+N9:dvVteka8+OtAcKlSRz5YHoWlHICt49
Malware Config
Extracted
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
onthelinux - Password:
741852abc
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2264 jusched.exe -
Loads dropped DLL 2 IoCs
pid Process 1940 18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495N.exe 1940 18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495N.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\c64f57ef\jusched.exe 18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495N.exe File created C:\Program Files (x86)\c64f57ef\c64f57ef 18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495N.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\Update23.job 18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1940 wrote to memory of 2264 1940 18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495N.exe 31 PID 1940 wrote to memory of 2264 1940 18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495N.exe 31 PID 1940 wrote to memory of 2264 1940 18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495N.exe 31 PID 1940 wrote to memory of 2264 1940 18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495N.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495N.exe"C:\Users\Admin\AppData\Local\Temp\18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495N.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Program Files (x86)\c64f57ef\jusched.exe"C:\Program Files (x86)\c64f57ef\jusched.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2264
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17B
MD5209aa6c14d66621f3aa1cee03a8bf5dc
SHA10f5bce2a29d3306586934b6d846a172078ee8e66
SHA25657ef9e3c809cf3ca41782d4c7119c3ae7e43ccbb1c00d978b745677f14b82c2e
SHA5128b9fb2bcc8e8785a48d3fe212f852c2f108ef2ab20e9e2a61e9bba5857002abe9111e42411bfc573e50c126031b7ef0433bddfa357de2ca0814f7d31157b9c63
-
Filesize
244KB
MD529e84cb95f1a4db06927ebf51b97b320
SHA1198d75b258d1921c8cbc1090de7203e22b96299d
SHA2560755d24024c2b15b0e9baa147b2fff30caf3484e0beac07ea2834908950182b8
SHA512f8db36f3bc581a27b2e04f176dd50a34017ee4a1175bcb550ffb062821a694b30fdd5b5cca16a31c7bd4b432dff435a848e188eb97be36a545bc3f78067d57d8