Analysis

  • max time kernel
    171s
  • max time network
    176s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-10-2022 00:18

General

  • Target

    5a09483c53aaba79762202b036cf62599c99b2da86243cc73a68cb6491e72c18.exe

  • Size

    28KB

  • MD5

    8260f91754bb4cd9bbacbb5121da3080

  • SHA1

    201faebc8e3b4916bc9519dc3436696c11118a91

  • SHA256

    5a09483c53aaba79762202b036cf62599c99b2da86243cc73a68cb6491e72c18

  • SHA512

    6cc1a357cbaefb671a7e004cbc6f6bd3781a794da34b58cd970801d405c8419b26fafaff308c6f65a75ce713597b89f825444d931e1f068a10cc2813000563fb

  • SSDEEP

    384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNp/vOz:Dv8IRRdsxq1DjJcqfag

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5a09483c53aaba79762202b036cf62599c99b2da86243cc73a68cb6491e72c18.exe
    "C:\Users\Admin\AppData\Local\Temp\5a09483c53aaba79762202b036cf62599c99b2da86243cc73a68cb6491e72c18.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:5064
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:632

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    1KB

    MD5

    ea71d6883b6ac8465653172898b45959

    SHA1

    b1683d9e3b7e75153a70ab138f709a12fac33032

    SHA256

    6ddaba426b88dfae37b3d65167e015396dbc9506a9a978769f8bccd3c31e3c58

    SHA512

    00b5a7a14b6c107798b5bd043edbf76a13465aa66c99f80c0fbed511c9498aea193a46ac3710d1423700e2ea7cfbf3a5656f850b1c774349ae811794f6f7bbb5

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    1KB

    MD5

    2dd703cb88c8fe8a9e43ba7e3daae4d1

    SHA1

    cf062772e0ef8c535ad41a4fa1f8e827c280a7de

    SHA256

    019627e4c854493c710d3a0a9a590d905d79ce5ab6d1df87a8bade4abb210864

    SHA512

    45375090e0f7ab789a5ac57cc07992e3da6faf73597e40d6e835ea97bfb82d1d545486f56e01aebb84ba805567a17027aec0309c59619e1a23e0d29d4f2b15f9

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    1KB

    MD5

    15c5f47124dc0eea133b1f7f83d52abd

    SHA1

    0ddc9366c3b6050d05aa6cc4cb1346680a466e5e

    SHA256

    032fa90f389a0adeec6a547f484c0e51cd109e0bea48b307a8434f0402a35203

    SHA512

    f0e0f8a05de9434375df397ee29f7c50123f1f0a28e04737bd7516f081da6dcd055e595cea55825eaf5044c4f78d822a76f8b6e9aab7b166c977e777897060d2

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/632-137-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/632-138-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5064-136-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB