Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 10:54
Static task
static1
Behavioral task
behavioral1
Sample
8d7a7ffff42993ee6e911091320ae9c6a72fd64566da4cd616b74862533a93ae.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
8d7a7ffff42993ee6e911091320ae9c6a72fd64566da4cd616b74862533a93ae.exe
Resource
win10v2004-20241007-en
General
-
Target
8d7a7ffff42993ee6e911091320ae9c6a72fd64566da4cd616b74862533a93ae.exe
-
Size
58KB
-
MD5
aa82ff487467ef88c65f0f3b95556c6f
-
SHA1
125c0b88815739170579f546aabf2553af774c69
-
SHA256
8d7a7ffff42993ee6e911091320ae9c6a72fd64566da4cd616b74862533a93ae
-
SHA512
69ce34ed88604aeaa0dac338b8f9c7779df7d09d66efc1a8dcf810269e857af1cb6b77828311c4f761e3fe377febcbe2822af7d3f8b5de7693f6a2d45c64083a
-
SSDEEP
1536:gQTIubHy5wQkJAejpzkGdxDLw3qMnd2wrtb:R4wPZpzNdxDL252ktb
Malware Config
Extracted
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
onthelinux - Password:
741852abc
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 8d7a7ffff42993ee6e911091320ae9c6a72fd64566da4cd616b74862533a93ae.exe -
Executes dropped EXE 1 IoCs
pid Process 2708 jusched.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\3c2e112\3c2e112 8d7a7ffff42993ee6e911091320ae9c6a72fd64566da4cd616b74862533a93ae.exe File created C:\Program Files (x86)\3c2e112\jusched.exe 8d7a7ffff42993ee6e911091320ae9c6a72fd64566da4cd616b74862533a93ae.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8d7a7ffff42993ee6e911091320ae9c6a72fd64566da4cd616b74862533a93ae.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe 2708 jusched.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2424 wrote to memory of 2708 2424 8d7a7ffff42993ee6e911091320ae9c6a72fd64566da4cd616b74862533a93ae.exe 86 PID 2424 wrote to memory of 2708 2424 8d7a7ffff42993ee6e911091320ae9c6a72fd64566da4cd616b74862533a93ae.exe 86 PID 2424 wrote to memory of 2708 2424 8d7a7ffff42993ee6e911091320ae9c6a72fd64566da4cd616b74862533a93ae.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d7a7ffff42993ee6e911091320ae9c6a72fd64566da4cd616b74862533a93ae.exe"C:\Users\Admin\AppData\Local\Temp\8d7a7ffff42993ee6e911091320ae9c6a72fd64566da4cd616b74862533a93ae.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Program Files (x86)\3c2e112\jusched.exe"C:\Program Files (x86)\3c2e112\jusched.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2708
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13B
MD5f253efe302d32ab264a76e0ce65be769
SHA1768685ca582abd0af2fbb57ca37752aa98c9372b
SHA25649dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
SHA5121990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
-
Filesize
58KB
MD5885518fde1f1aacf1901272c6cc058a3
SHA1d6193d87b498fe30e15e033c0837b4ac00b34150
SHA256b0f4914edeb47d9d9b92735454537e08d6e9c6b42e9e3e5299e7584c3e1af5bf
SHA512872221598aeff8fed2e4fe3574b0eac7c83e27acab0ae8a6cdb4a7503a1c5b35d8f9234bff813b4d4f9bf1808bc53fedf82504090c43fb17279e911579fde200