5058fb7a26e606441356452f6b176a5f6bc51bd906890b1c0c0059b24dab087a

General

Target

1383cc8ff27380604cfe4ffbd13177bf.exe
Size

40KB
MD5

1383cc8ff27380604cfe4ffbd13177bf
SHA1

5424565a43eb86ea39251df6bfbfd344c3a7a6a1
SHA256

5058fb7a26e606441356452f6b176a5f6bc51bd906890b1c0c0059b24dab087a
SHA512

6bf71d1d8cc34ae3e0b431d36085d36888e665dd7b60d3affd31edc7180a4abe19ac62324f91dd7e33f571d39b816b53455c4650ba074235e0cbb4b545eb16e3
SSDEEP

768:aq9m/ZsybSg2ts4L3RLc/qjhsKmHbk1+qJ0UtHq6SP:aqk/Zdic/qjh8w19JDHq6SP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2160	services.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000023207-4.dat	upx
behavioral2/memory/2160-7-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2160-13-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2160-17-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2160-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2160-22-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2160-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2160-30-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2160-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2160-35-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2160-124-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2160-151-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2160-165-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2160-169-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2160-180-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2160-214-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	1383cc8ff27380604cfe4ffbd13177bf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	1383cc8ff27380604cfe4ffbd13177bf.exe
File opened for modification	C:\Windows\java.exe	1383cc8ff27380604cfe4ffbd13177bf.exe
File created	C:\Windows\java.exe	1383cc8ff27380604cfe4ffbd13177bf.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 2160	4004	1383cc8ff27380604cfe4ffbd13177bf.exe	89
PID 4004 wrote to memory of 2160	4004	1383cc8ff27380604cfe4ffbd13177bf.exe	89
PID 4004 wrote to memory of 2160	4004	1383cc8ff27380604cfe4ffbd13177bf.exe	89

C:\Users\Admin\AppData\Local\Temp\1383cc8ff27380604cfe4ffbd13177bf.exe
"C:\Users\Admin\AppData\Local\Temp\1383cc8ff27380604cfe4ffbd13177bf.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BJCNBC62\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QSO8CY24\default[8].htm

Filesize
312B

MD5
c15952329e9cd008b41f979b6c76b9a2

SHA1
53c58cc742b5a0273df8d01ba2779a979c1ff967

SHA256
5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7

SHA512
6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\R977VUU4\default[1].htm

Filesize
315B

MD5
14b82aec966e8e370a28053db081f4e9

SHA1
a0f30ebbdb4c69947d3bd41fa63ec4929dddd649

SHA256
202eada95ef503b303a05caf5a666f538236c7e697f5301fd178d994fa6e24cf

SHA512
ec04f1d86137dc4d75a47ba47bb2f2c912115372fa000cf986d13a04121aae9974011aa716c7da3893114e0d5d0e2fb680a6c2fd40a1f93f0e0bfd6fd625dfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp875E.tmp

Filesize
40KB

MD5
c7260e1f83610654358c566fde12d44f

SHA1
5c760baf7c443460528bd277b36bdd28d0480982

SHA256
7e9b6641cad4c33eb74f84c50f5393c5b1526ba4f0a5035c41e537cefc276e47

SHA512
224ab954be39fe3890b506b438144e6f77034bf0d8a7e6eab904a525b7c2a0184ff612f14467196a90932c21feff4f4d171493f05b117272b1dc6111421a97d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
dd044f1ca508a2d4b66517348f14a5be

SHA1
b1043df2b1ebc81737e6898ae7f00966bbf98cfb

SHA256
5c3fd148a13de0a15361ae28d3f4138c4bfda6e4edc0cc0611b6cc0e01cfb0af

SHA512
809634052162e00d4bc91736ac2cccd30ca5f37b1c91c386534f3b00bd98422ac46930003230031c8c700183c806f23d0c19098efe46eca4dd2ee318070e78e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
33f632ccd5a29720fcc409c4f5f2b879

SHA1
98144abcce809408eab54a9effde173eecd01dc3

SHA256
fa4d93c7279205f95ab58b31d9d2e96c729a2fd0b1b09bf13a3c0f66384ca1fc

SHA512
1204fc23c3b987fe70a04cdae4c7a0a293f3ae60ec1d1fa98c7aeb3d4b02e8bba42e47713dfe0107a94ef35ab7df2318b35c2fb555e785a3d0e4d5f1f9198617

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
f8b6b7b53e0b6e136bc8b66b8672c188

SHA1
f2b62e9d7d24e68ba97c1a95d37e89f032d465fe

SHA256
4fa401a0bba7a2828855511e51da2c6fe461213c66f5f7cfc2c459442c1b322e

SHA512
9dc7c34a96b483c39e69901a52068ec36a3ca2057c28f960c1c960f65a74237057b148e7a503ffb86c6d4b4104c4aed84b6f7c44364ae7aff9a74f3195713622

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2160-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2160-169-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2160-35-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2160-30-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2160-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2160-22-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2160-124-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2160-7-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2160-151-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2160-165-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2160-31-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2160-17-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2160-180-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2160-214-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2160-13-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4004-0-0x0000000000500000-0x000000000050D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads