59b3de8092d969ad749bbcce84e5378c7af11365e00568eb05e0ef2fa8f20b59

General

Target

0aca8ad159cb905612ad74371ffa7600.exe
Size

28KB
MD5

0aca8ad159cb905612ad74371ffa7600
SHA1

84562d06aaf86d365f635a78d67f4ad5943331e3
SHA256

59b3de8092d969ad749bbcce84e5378c7af11365e00568eb05e0ef2fa8f20b59
SHA512

55ec688478d530267e64711daa0ef352a4afa943008ed82c7538cefd4d7010151dc1432b998808eed55474c8af734c3487c4dbc4039755bbd38083938ddb4c3a
SSDEEP

384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNaQEH:Dv8IRRdsxq1DjJcqfLF

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1744	services.exe

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2164-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x000c000000013378-7.dat	upx
behavioral1/memory/2164-4-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1744-11-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2164-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1744-18-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1744-25-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1744-30-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1744-32-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1744-37-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1744-42-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1744-44-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2164-48-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1744-49-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2164-53-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1744-54-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2164-55-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1744-56-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x000700000000f6f8-69.dat	upx
behavioral1/memory/2164-79-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1744-80-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2164-84-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1744-85-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2164-86-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1744-87-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2164-91-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1744-92-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	0aca8ad159cb905612ad74371ffa7600.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\java.exe	0aca8ad159cb905612ad74371ffa7600.exe
File created	C:\Windows\java.exe	0aca8ad159cb905612ad74371ffa7600.exe
File created	C:\Windows\services.exe	0aca8ad159cb905612ad74371ffa7600.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 1744	2164	0aca8ad159cb905612ad74371ffa7600.exe	28
PID 2164 wrote to memory of 1744	2164	0aca8ad159cb905612ad74371ffa7600.exe	28
PID 2164 wrote to memory of 1744	2164	0aca8ad159cb905612ad74371ffa7600.exe	28
PID 2164 wrote to memory of 1744	2164	0aca8ad159cb905612ad74371ffa7600.exe	28

C:\Users\Admin\AppData\Local\Temp\0aca8ad159cb905612ad74371ffa7600.exe
"C:\Users\Admin\AppData\Local\Temp\0aca8ad159cb905612ad74371ffa7600.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2205.tmp

Filesize
28KB

MD5
c1be566d0b525986ea76357da0660ce6

SHA1
149ea05ec46cc74d1f068828f6ee3687534090b3

SHA256
17186d7352e494e95d70331735245ee0ea0403e1426b80776451cd7e4e5f1c10

SHA512
f998d1f042dc041dba68b0c4930cc8c9c4915825b9221cf514592cee43bbd0a689c94e4ebc8a3ecee87749e4a7f40d6b6fc602f6097852b631115fd43407e2f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
e047f2c0bb7d80d4031aee36b73f6d82

SHA1
b107d158b0cb8878476115e2356984a43af80a0e

SHA256
e3c854cf83afb62372b705316cf88ef95a423c3db2fa71f3d3917153bd2103bf

SHA512
3efeae9a50bdf39783940e0084e824145bb96d67501cc919412cb21de70ae4c430b95a97aee33e9ef3e44abb7bdd3194e19389213cb9744200dbb5bdf0ae8bdd

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1744-80-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1744-30-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1744-85-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1744-18-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1744-54-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1744-87-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1744-25-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1744-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1744-32-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1744-37-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1744-42-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1744-44-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1744-92-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1744-49-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1744-56-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2164-48-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2164-55-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2164-53-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2164-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2164-23-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2164-79-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2164-22-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2164-84-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2164-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2164-86-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2164-9-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2164-91-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2164-4-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads