113b47de7b19b436d5f401ba1f46c740a18db44041b8804932f7a0908111eb17

General

Target

113b47de7b19b436d5f401ba1f46c740a18db44041b8804932f7a0908111eb17N.exe
Size

336KB
MD5

b75343e6bec3195db848f19055e27430
SHA1

96bb86610eb4f4d539c33f2a22b609546e5998e6
SHA256

113b47de7b19b436d5f401ba1f46c740a18db44041b8804932f7a0908111eb17
SHA512

aeb6d1e7232a85738db12f85c2449c6de57469d79b08eb7f8592c16251e195b3c8687d868e4ed9680d308745302ce9deb4fe434fe31afee41530d136fa9046c1
SSDEEP

6144:d3naj96sWrnc/ZKBgwioSPrzq1UUiGjoSiA5bmt:9naM8EBVSPvqJiGjoSi86t

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2812	jusched121.exe
2904	jusched121.exe

Loads dropped DLL 6 IoCs

pid	Process
2736	113b47de7b19b436d5f401ba1f46c740a18db44041b8804932f7a0908111eb17N.exe
2736	113b47de7b19b436d5f401ba1f46c740a18db44041b8804932f7a0908111eb17N.exe
2736	113b47de7b19b436d5f401ba1f46c740a18db44041b8804932f7a0908111eb17N.exe
2736	113b47de7b19b436d5f401ba1f46c740a18db44041b8804932f7a0908111eb17N.exe
2736	113b47de7b19b436d5f401ba1f46c740a18db44041b8804932f7a0908111eb17N.exe
2812	jusched121.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\849753894 = "C:\\Users\\Admin\\AppData\\Roaming\\jusched121.exe"	reg.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2812 set thread context of 0	2812	jusched121.exe
PID 2812 set thread context of 2904	2812	jusched121.exe	34

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2736-0-0x0000000000400000-0x00000000005B3000-memory.dmp	upx
behavioral1/files/0x001200000001626d-27.dat	upx
behavioral1/memory/2736-46-0x0000000000400000-0x00000000005B3000-memory.dmp	upx
behavioral1/memory/2812-49-0x0000000000400000-0x00000000005B3000-memory.dmp	upx
behavioral1/memory/2904-52-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2904-58-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2812-55-0x0000000000400000-0x00000000005B3000-memory.dmp	upx
behavioral1/memory/2904-60-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2904-59-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2904-63-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	113b47de7b19b436d5f401ba1f46c740a18db44041b8804932f7a0908111eb17N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jusched121.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jusched121.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2904	jusched121.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2736	113b47de7b19b436d5f401ba1f46c740a18db44041b8804932f7a0908111eb17N.exe
2812	jusched121.exe
2904	jusched121.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2800	2736	113b47de7b19b436d5f401ba1f46c740a18db44041b8804932f7a0908111eb17N.exe	30
PID 2736 wrote to memory of 2800	2736	113b47de7b19b436d5f401ba1f46c740a18db44041b8804932f7a0908111eb17N.exe	30
PID 2736 wrote to memory of 2800	2736	113b47de7b19b436d5f401ba1f46c740a18db44041b8804932f7a0908111eb17N.exe	30
PID 2736 wrote to memory of 2800	2736	113b47de7b19b436d5f401ba1f46c740a18db44041b8804932f7a0908111eb17N.exe	30
PID 2800 wrote to memory of 2932	2800	cmd.exe	32
PID 2800 wrote to memory of 2932	2800	cmd.exe	32
PID 2800 wrote to memory of 2932	2800	cmd.exe	32
PID 2800 wrote to memory of 2932	2800	cmd.exe	32
PID 2736 wrote to memory of 2812	2736	113b47de7b19b436d5f401ba1f46c740a18db44041b8804932f7a0908111eb17N.exe	33
PID 2736 wrote to memory of 2812	2736	113b47de7b19b436d5f401ba1f46c740a18db44041b8804932f7a0908111eb17N.exe	33
PID 2736 wrote to memory of 2812	2736	113b47de7b19b436d5f401ba1f46c740a18db44041b8804932f7a0908111eb17N.exe	33
PID 2736 wrote to memory of 2812	2736	113b47de7b19b436d5f401ba1f46c740a18db44041b8804932f7a0908111eb17N.exe	33
PID 2812 wrote to memory of 0	2812	jusched121.exe
PID 2812 wrote to memory of 0	2812	jusched121.exe
PID 2812 wrote to memory of 0	2812	jusched121.exe
PID 2812 wrote to memory of 0	2812	jusched121.exe
PID 2812 wrote to memory of 0	2812	jusched121.exe
PID 2812 wrote to memory of 2904	2812	jusched121.exe	34
PID 2812 wrote to memory of 2904	2812	jusched121.exe	34
PID 2812 wrote to memory of 2904	2812	jusched121.exe	34
PID 2812 wrote to memory of 2904	2812	jusched121.exe	34
PID 2812 wrote to memory of 2904	2812	jusched121.exe	34
PID 2812 wrote to memory of 2904	2812	jusched121.exe	34
PID 2812 wrote to memory of 2904	2812	jusched121.exe	34
PID 2812 wrote to memory of 2904	2812	jusched121.exe	34
PID 2812 wrote to memory of 2904	2812	jusched121.exe	34

C:\Users\Admin\AppData\Local\Temp\113b47de7b19b436d5f401ba1f46c740a18db44041b8804932f7a0908111eb17N.exe
"C:\Users\Admin\AppData\Local\Temp\113b47de7b19b436d5f401ba1f46c740a18db44041b8804932f7a0908111eb17N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\VUOzY.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "849753894" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\jusched121.exe" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:2932
- C:\Users\Admin\AppData\Roaming\jusched121.exe
  "C:\Users\Admin\AppData\Roaming\jusched121.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Users\Admin\AppData\Roaming\jusched121.exe
    C:\Users\Admin\AppData\Roaming\jusched121.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\VUOzY.bat

Filesize
141B

MD5
f29af156d2290b132c12fc7a52b915e7

SHA1
de5dd6043c236ef9306ff49b7fbf262610f22f24

SHA256
e9f28b9b7c75824f287698650968b9812525409ac5e5095b5d49247da3ffa99b

SHA512
bd9fca2bb4c609cb6887b9d8532a51611a090b2234dbcd2f4c735e3040bf10128fd5e26fd9d9e4afe47518b12d66e26e35db7802ef00f15ebf232cf2a634e7aa

Download Submit
C:\Users\Admin\AppData\Roaming\jusched121.exe

Filesize
336KB

MD5
ccb80be3e736a938f9d1f0f830380b8e

SHA1
9335cbbe91ac81f579d91bc696c048e4a27770b2

SHA256
b79025a69898cc47f351dbddad3e5c838d3f0825b34de0b75167a8a1c4a1c500

SHA512
81d48a910c24e6358cb79b7d505f2e2ba7400f92e6f1cf4fea2ddda4b3d396857c32aa2cbe5146f119a59820c4f4a08191568e8e8284c13667e4d47fce6ba94b

Download Submit
memory/2736-0-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/2736-46-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/2736-43-0x0000000003130000-0x00000000032E3000-memory.dmp

Filesize
1.7MB

Download
memory/2736-42-0x0000000003130000-0x00000000032E3000-memory.dmp

Filesize
1.7MB

Download
memory/2812-49-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/2812-55-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/2904-52-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2904-58-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2904-60-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2904-59-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2904-63-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads