Analysis
-
max time kernel
119s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 21:36
Static task
static1
Behavioral task
behavioral1
Sample
3109378d8a89b20d760d263ff23b60ca7f7b2dac0a9003e52df47d963731c909N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3109378d8a89b20d760d263ff23b60ca7f7b2dac0a9003e52df47d963731c909N.exe
Resource
win10v2004-20241007-en
General
-
Target
3109378d8a89b20d760d263ff23b60ca7f7b2dac0a9003e52df47d963731c909N.exe
-
Size
57KB
-
MD5
fb0e97f2bc40a04a5a157200c05b0390
-
SHA1
297223ad51eb05b249e0d2336b515fd6ab46aca7
-
SHA256
3109378d8a89b20d760d263ff23b60ca7f7b2dac0a9003e52df47d963731c909
-
SHA512
a05b4595b0a935b0b00798b4a2f393ac15214ce0b919aa34735329f2508d5305754756d1981a4a9784782d4f57f4f6ce5dcdfa74fe68c247e97ea1203988d775
-
SSDEEP
1536:gQTIubHy5wQkJAejpzkGdxDLbe5vfhvqa3TmS:R4wPZpzNdxDLb6vfhv8S
Malware Config
Extracted
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
onthelinux - Password:
741852abc
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 3109378d8a89b20d760d263ff23b60ca7f7b2dac0a9003e52df47d963731c909N.exe -
Executes dropped EXE 1 IoCs
pid Process 4152 jusched.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\5eaaffe5\5eaaffe5 3109378d8a89b20d760d263ff23b60ca7f7b2dac0a9003e52df47d963731c909N.exe File created C:\Program Files (x86)\5eaaffe5\jusched.exe 3109378d8a89b20d760d263ff23b60ca7f7b2dac0a9003e52df47d963731c909N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3109378d8a89b20d760d263ff23b60ca7f7b2dac0a9003e52df47d963731c909N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe 4152 jusched.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4660 wrote to memory of 4152 4660 3109378d8a89b20d760d263ff23b60ca7f7b2dac0a9003e52df47d963731c909N.exe 90 PID 4660 wrote to memory of 4152 4660 3109378d8a89b20d760d263ff23b60ca7f7b2dac0a9003e52df47d963731c909N.exe 90 PID 4660 wrote to memory of 4152 4660 3109378d8a89b20d760d263ff23b60ca7f7b2dac0a9003e52df47d963731c909N.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\3109378d8a89b20d760d263ff23b60ca7f7b2dac0a9003e52df47d963731c909N.exe"C:\Users\Admin\AppData\Local\Temp\3109378d8a89b20d760d263ff23b60ca7f7b2dac0a9003e52df47d963731c909N.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Program Files (x86)\5eaaffe5\jusched.exe"C:\Program Files (x86)\5eaaffe5\jusched.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4152
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13B
MD5f253efe302d32ab264a76e0ce65be769
SHA1768685ca582abd0af2fbb57ca37752aa98c9372b
SHA25649dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
SHA5121990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
-
Filesize
57KB
MD503e3ef99ad5c9215dce5fd8f238302ce
SHA17ea3a39b369bff72b73846ae915a9e788600d53e
SHA2560bdb66a52aa844aa709c247c5fbbb49fe205266f76a564d7eaa4822e78d4e7be
SHA51270e73225cfefd7644e1bf2e1ed0bf3116230053fcd87f0b610df47cbd99daac248502f831c550bd85bcf6815ccdc383f4cd6ccba26a6f9f734b0b0dc4c3e30e7