e3e3faeec6eba6c77243bc54e4514ffd90a81e07fa5d143d69419f9523bba33e

General

Target

01623812f780bdf8b3071602e2517f77.exe
Size

40KB
MD5

01623812f780bdf8b3071602e2517f77
SHA1

198079f0bfeb405f2b0b09eb0a412c2a6acfcec8
SHA256

e3e3faeec6eba6c77243bc54e4514ffd90a81e07fa5d143d69419f9523bba33e
SHA512

3a348c4dfcd5486f81e3caf5827153dd1976b26179c59e00ae4cbd57fbd362cca5546cae36e8b7f7cf6f6f9f63dcaf5220697940a42f1608aa7b46b71c29a8a5
SSDEEP

768:aq9m/ZsybSg2ts4L3RLc/qjhsKmHbk1+qJ0UtHyOB:aqk/Zdic/qjh8w19JDHtB

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1720	services.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1256-4-0x0000000000220000-0x0000000000228000-memory.dmp	upx
behavioral1/files/0x000b0000000140fb-8.dat	upx
behavioral1/memory/1720-11-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1720-17-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1720-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1720-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1720-27-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1720-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1720-35-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1720-36-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1720-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1720-63-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1720-64-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1720-68-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1720-72-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1720-73-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1720-77-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	01623812f780bdf8b3071602e2517f77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\java.exe	01623812f780bdf8b3071602e2517f77.exe
File created	C:\Windows\java.exe	01623812f780bdf8b3071602e2517f77.exe
File created	C:\Windows\services.exe	01623812f780bdf8b3071602e2517f77.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 1720	1256	01623812f780bdf8b3071602e2517f77.exe	28
PID 1256 wrote to memory of 1720	1256	01623812f780bdf8b3071602e2517f77.exe	28
PID 1256 wrote to memory of 1720	1256	01623812f780bdf8b3071602e2517f77.exe	28
PID 1256 wrote to memory of 1720	1256	01623812f780bdf8b3071602e2517f77.exe	28

C:\Users\Admin\AppData\Local\Temp\01623812f780bdf8b3071602e2517f77.exe
"C:\Users\Admin\AppData\Local\Temp\01623812f780bdf8b3071602e2517f77.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3CA.tmp

Filesize
40KB

MD5
a326ee3632448c02d232f778f38c8359

SHA1
bb8fc9247440501d39ef8b9895793213386cf3d3

SHA256
af0969663a87afb2a678a1445893ce2fc8d1dc046c979788f7f4f03dfaa6f111

SHA512
7e84ed0c69455aae81c6d9973c227c6ced6f397dbd00e53789985103972d40e8d1d92abdc497ff4d2a6fde5ea5cbd9ed8705391feb244b2137aaefdab9a9e5f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
e3191c709a49a0659daa497090dd81c3

SHA1
8821eca38d6170df181bca89e91298e399039c61

SHA256
9759b7164da3a99bf0e46d32389a35e17269ac51929ede6b900dbaf6b3a67e24

SHA512
7b7a5ef3448533c70c2dc589670482c07a174242d9e6f0c3db34b3abd2cfa7c8940f5f3d5339c1380bc59f1525fc96144a8fc4bad61e465a91d94411a393f754

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1256-22-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/1256-4-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/1256-0-0x0000000000500000-0x000000000050D000-memory.dmp

Filesize
52KB

Download
memory/1256-10-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/1720-36-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1720-17-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1720-27-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1720-31-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1720-35-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1720-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1720-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1720-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1720-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1720-63-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1720-64-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1720-68-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1720-72-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1720-73-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1720-77-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads