Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/11/2024, 22:56
Static task
static1
Behavioral task
behavioral1
Sample
6583877081e981f13a11797965882cdd16175455e2cdbfc00c2a23cf9ff9137e.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6583877081e981f13a11797965882cdd16175455e2cdbfc00c2a23cf9ff9137e.exe
Resource
win10v2004-20241007-en
General
-
Target
6583877081e981f13a11797965882cdd16175455e2cdbfc00c2a23cf9ff9137e.exe
-
Size
50KB
-
MD5
8f8ac7483ecf3a1faed70cdc47a3f19c
-
SHA1
2359d912d37fac9180881fd874952af3d79e4d9d
-
SHA256
6583877081e981f13a11797965882cdd16175455e2cdbfc00c2a23cf9ff9137e
-
SHA512
b9191ff6db91502610c9c6bb095f4ff5c8e0235848d0271bdd2b546be5440a2a0104eedc51aed1ea6f0c8dc6ab28d7faad309e6807389b1fe11213ad929ab9db
-
SSDEEP
768:mzQYScGrIubHuYtvdxwYHw5FAe2Qkncwx9vMdJTeTXpnHTkGrbHdrzxDvDw3qMMD:gQTIubHy5wQkJAejpzkGdxDLw3qMGlKG
Malware Config
Extracted
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
onthelinux - Password:
741852abc
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1648 jusched.exe -
Loads dropped DLL 2 IoCs
pid Process 2908 6583877081e981f13a11797965882cdd16175455e2cdbfc00c2a23cf9ff9137e.exe 2908 6583877081e981f13a11797965882cdd16175455e2cdbfc00c2a23cf9ff9137e.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\f8e52eaa\jusched.exe 6583877081e981f13a11797965882cdd16175455e2cdbfc00c2a23cf9ff9137e.exe File created C:\Program Files (x86)\f8e52eaa\f8e52eaa 6583877081e981f13a11797965882cdd16175455e2cdbfc00c2a23cf9ff9137e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6583877081e981f13a11797965882cdd16175455e2cdbfc00c2a23cf9ff9137e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe 1648 jusched.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2908 wrote to memory of 1648 2908 6583877081e981f13a11797965882cdd16175455e2cdbfc00c2a23cf9ff9137e.exe 28 PID 2908 wrote to memory of 1648 2908 6583877081e981f13a11797965882cdd16175455e2cdbfc00c2a23cf9ff9137e.exe 28 PID 2908 wrote to memory of 1648 2908 6583877081e981f13a11797965882cdd16175455e2cdbfc00c2a23cf9ff9137e.exe 28 PID 2908 wrote to memory of 1648 2908 6583877081e981f13a11797965882cdd16175455e2cdbfc00c2a23cf9ff9137e.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\6583877081e981f13a11797965882cdd16175455e2cdbfc00c2a23cf9ff9137e.exe"C:\Users\Admin\AppData\Local\Temp\6583877081e981f13a11797965882cdd16175455e2cdbfc00c2a23cf9ff9137e.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Program Files (x86)\f8e52eaa\jusched.exe"C:\Program Files (x86)\f8e52eaa\jusched.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1648
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13B
MD5f253efe302d32ab264a76e0ce65be769
SHA1768685ca582abd0af2fbb57ca37752aa98c9372b
SHA25649dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
SHA5121990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
-
Filesize
50KB
MD5f3a188ad4f6e09b7d5ca8c1ec8e4c549
SHA14312feb6529b057b5932e17cb3e5414e60e78aa0
SHA256a214a926dea701af41a98dfb63710eb5e8f99b9a40a4ff6f04c580e86ed6cbc0
SHA51246beeb1d2388257e4ae604bf59fcdae665ca12c691b71dc0716d2501655ec1ef865b0924468d0476b7bd26c1b12b0eebcba946be03a462a67f24d66c19ef3c0b