c601fa79359743e08924c10f73d8729e3c4ed2185d9e3488f58a94a55d678ce6

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2022, 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c601fa79359743e08924c10f73d8729e3c4ed2185d9e3488f58a94a55d678ce6.exe
Size

432KB
MD5

6a775b77c0b2ca3d46c19f242e475234
SHA1

1789f4b9cd45365430d5a37838b847459b36ef5e
SHA256

c601fa79359743e08924c10f73d8729e3c4ed2185d9e3488f58a94a55d678ce6
SHA512

91b8ba5192ec503233d84b7fcf88d673d0f0c1b833d0e8d717602c45e621658fe27564e8d781824f5d0c82bb286f122ae6ab69b97b686d4b78c8b5986aaca1bd
SSDEEP

6144:RqlIyFESWu0SWu2smW+Dffz1gUZ3sOeNw0VqIJ/uJn9tvq3v3/sSQJw1T3:tyosmW+Dfhg0cvd5JIDvTJw1b

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1324	Zombie.exe
1944	_7z.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	c601fa79359743e08924c10f73d8729e3c4ed2185d9e3488f58a94a55d678ce6.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	c601fa79359743e08924c10f73d8729e3c4ed2185d9e3488f58a94a55d678ce6.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.8.0_66\jre\bin\jpeg.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-spi-quicksearch.xml.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\locale\boot_zh_CN.jar.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_ja.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jre1.8.0_66\lib\security\US_export_policy.jar.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri Light-Constantia.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\LucidaSansRegular.ttf.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_ja.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\javax.xml_1.3.4.v201005080400.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench_1.2.1.v20140901-1244.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_zh_CN.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-text_zh_CN.jar.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_zh_4.4.0.v20140623020002.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_ja.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_ja.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-heapwalker.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-charts.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticnotification.exsd.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application.jar.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_pl.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\cursors.properties.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-tools.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_zh_CN.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-heapdump.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_de.properties.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper.registry_1.0.300.v20130327-1442.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_ja_4.4.0.v20140623020002.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-sampler.xml.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-sendopts.xml.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	Zombie.exe
File created	C:\Program Files\Java\jre1.8.0_66\bin\nio.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\id.pak.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\Welcome.html.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\core\locale\core_ja.jar.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-dialogs.xml.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-charts.xml.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_ja.jar.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\tr.pak.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\bin\jsound.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.intro_3.4.200.v20130326-1254.jar.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 1324	1968	c601fa79359743e08924c10f73d8729e3c4ed2185d9e3488f58a94a55d678ce6.exe	83
PID 1968 wrote to memory of 1324	1968	c601fa79359743e08924c10f73d8729e3c4ed2185d9e3488f58a94a55d678ce6.exe	83
PID 1968 wrote to memory of 1324	1968	c601fa79359743e08924c10f73d8729e3c4ed2185d9e3488f58a94a55d678ce6.exe	83
PID 1968 wrote to memory of 1944	1968	c601fa79359743e08924c10f73d8729e3c4ed2185d9e3488f58a94a55d678ce6.exe	84
PID 1968 wrote to memory of 1944	1968	c601fa79359743e08924c10f73d8729e3c4ed2185d9e3488f58a94a55d678ce6.exe	84
PID 1968 wrote to memory of 1944	1968	c601fa79359743e08924c10f73d8729e3c4ed2185d9e3488f58a94a55d678ce6.exe	84

C:\Users\Admin\AppData\Local\Temp\c601fa79359743e08924c10f73d8729e3c4ed2185d9e3488f58a94a55d678ce6.exe
"C:\Users\Admin\AppData\Local\Temp\c601fa79359743e08924c10f73d8729e3c4ed2185d9e3488f58a94a55d678ce6.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1324
- C:\Users\Admin\AppData\Local\Temp\_7z.exe
  "_7z.exe"
  2⤵
  - Executes dropped EXE
  PID:1944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\desktop.ini.tmp

Filesize
148KB

MD5
2d730fe34a7e160c03c3f48684421894

SHA1
f40792b458eaacfcc75ba288c0de3b790f1a1f48

SHA256
f32938710732c1ae55f6e25e77848d2d0c3dc0de5c559b31d0750a2ba0bedac1

SHA512
6e72140ecc9ed3af0341c2b12e437cc95e9c49e563cfbadca624c7b2ea834fd6a23e7226ee9b061e68415f4661c6eb88d4b08e7659548a7bcf5bf6309f1323fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_7z.exe

Filesize
284KB

MD5
a42b35f975d88c1370a7aff084ee57a7

SHA1
bee1408fe0b15f6f719f003e46aee5ec424cf608

SHA256
56cc9e7e3767c0cffae8161bf0ad13457487c1b422e2879b897dbd4bab115776

SHA512
b92d05515e18277db660118934e70678ee2a3bb66005bad19bb417ffaedb22a63727a5a697ca3ac0f6c48f6f5593ba45ab80f4ebdc0eaed10d80b7af04d45b23

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
148KB

MD5
ff3c3ec7dea26b0f0306bf70fe709c68

SHA1
1b32c00744fdbc0b1b69b78765db14a372e4a5db

SHA256
c011ca4fb7cb44665fb5f7e2a4183b258a94404f77348135131a246033ecae10

SHA512
e2f7a2078d9eeec2b8cc174523271ed604f619fe9cb8b648f79c903d10e4fd2213462060ecb5aacf6c0024e44ccf582ef95e9efc47de29553601b0bf4e2e9eb7

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
148KB

MD5
ff3c3ec7dea26b0f0306bf70fe709c68

SHA1
1b32c00744fdbc0b1b69b78765db14a372e4a5db

SHA256
c011ca4fb7cb44665fb5f7e2a4183b258a94404f77348135131a246033ecae10

SHA512
e2f7a2078d9eeec2b8cc174523271ed604f619fe9cb8b648f79c903d10e4fd2213462060ecb5aacf6c0024e44ccf582ef95e9efc47de29553601b0bf4e2e9eb7

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads