18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495

General

Target

18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495N.exe
Size

244KB
MD5

7772dd776f6f1dd6c4606d22a3a81170
SHA1

872d64d114b9c32d17b707ac6babd9af58602a45
SHA256

18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495
SHA512

fb39bfa63761bcc3231e51f0174d3ab4912ae326463f6071d8438035ab41cafde3b697ae803ffa67bd3fb56fa985c325cd10511d02aec9e7bd33e6213cf5483e
SSDEEP

1536:dvVte+7YkayZ+OttmxKLjWlSA8Zp5JAJjkrSHoW8MHCCSdCes+N9:dvVteka8+OtAcKlSRz5YHoWlHICt49

Score

10^/10

discovery

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Signatures

Executes dropped EXE 1 IoCs

Processes:

jusched.exe

pid	Process
2264	jusched.exe

Loads dropped DLL 2 IoCs

Processes:

18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495N.exe

pid	Process
1940	18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495N.exe
1940	18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495N.exe

Drops file in Program Files directory 2 IoCs

Processes:

18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495N.exe

description	ioc	Process
File created	C:\Program Files (x86)\c64f57ef\jusched.exe	18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495N.exe
File created	C:\Program Files (x86)\c64f57ef\c64f57ef	18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495N.exe

Drops file in Windows directory 1 IoCs

Processes:

18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495N.exe

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495N.exejusched.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jusched.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495N.exe

description	pid	Process	procid_target
PID 1940 wrote to memory of 2264	1940	18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495N.exe	31
PID 1940 wrote to memory of 2264	1940	18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495N.exe	31
PID 1940 wrote to memory of 2264	1940	18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495N.exe	31
PID 1940 wrote to memory of 2264	1940	18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495N.exe	31

C:\Users\Admin\AppData\Local\Temp\18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495N.exe
"C:\Users\Admin\AppData\Local\Temp\18e5b02e188d3b4d72a5808bd8055410ff26601aa4953ae4cbd9c482d33a1495N.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Program Files (x86)\c64f57ef\jusched.exe
  "C:\Program Files (x86)\c64f57ef\jusched.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\c64f57ef\c64f57ef

Filesize
17B

MD5
209aa6c14d66621f3aa1cee03a8bf5dc

SHA1
0f5bce2a29d3306586934b6d846a172078ee8e66

SHA256
57ef9e3c809cf3ca41782d4c7119c3ae7e43ccbb1c00d978b745677f14b82c2e

SHA512
8b9fb2bcc8e8785a48d3fe212f852c2f108ef2ab20e9e2a61e9bba5857002abe9111e42411bfc573e50c126031b7ef0433bddfa357de2ca0814f7d31157b9c63

Download Submit
\Program Files (x86)\c64f57ef\jusched.exe

Filesize
244KB

MD5
29e84cb95f1a4db06927ebf51b97b320

SHA1
198d75b258d1921c8cbc1090de7203e22b96299d

SHA256
0755d24024c2b15b0e9baa147b2fff30caf3484e0beac07ea2834908950182b8

SHA512
f8db36f3bc581a27b2e04f176dd50a34017ee4a1175bcb550ffb062821a694b30fdd5b5cca16a31c7bd4b432dff435a848e188eb97be36a545bc3f78067d57d8

Download Submit
memory/1940-0-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1940-7-0x0000000002B90000-0x0000000002C0E000-memory.dmp

Filesize
504KB

Download
memory/1940-13-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1940-12-0x0000000002B90000-0x0000000002C0E000-memory.dmp

Filesize
504KB

Download
memory/2264-15-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2264-17-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads