42cfc6a310db68bf46dd4626fe340b20efd0bc01889aa87410f8648b5fe9dae9

General

Target

4a28d49601381642a149a3ddaab73335.exe
Size

40KB
MD5

4a28d49601381642a149a3ddaab73335
SHA1

5bb6aa3ac0a383c83dd31abfbff36fbcfe315001
SHA256

42cfc6a310db68bf46dd4626fe340b20efd0bc01889aa87410f8648b5fe9dae9
SHA512

bdc3dfee0479f2c73fb1c62a144a4f92a0666e763aa10d921944ddacc4adcc9e72511d17b1e5bb9fd07d0c91368b6f1bc0e09c77d9242275e21729d57f0173a3
SSDEEP

768:aq9m/ZsybSg2ts4L3RLc/qjhsKmHbk1+qJ0UtHJBKl8P:aqk/Zdic/qjh8w19JDHLP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2492	services.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2044-7-0x0000000000220000-0x0000000000228000-memory.dmp	upx
behavioral1/files/0x0009000000012270-6.dat	upx
behavioral1/memory/2492-10-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2492-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2492-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2492-22-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2492-27-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2492-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2492-32-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2492-36-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2492-37-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2492-55-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2492-58-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2492-59-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2492-63-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2492-67-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2492-68-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2492-72-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	4a28d49601381642a149a3ddaab73335.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	4a28d49601381642a149a3ddaab73335.exe
File opened for modification	C:\Windows\java.exe	4a28d49601381642a149a3ddaab73335.exe
File created	C:\Windows\java.exe	4a28d49601381642a149a3ddaab73335.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	4a28d49601381642a149a3ddaab73335.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	4a28d49601381642a149a3ddaab73335.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2492	2044	4a28d49601381642a149a3ddaab73335.exe	28
PID 2044 wrote to memory of 2492	2044	4a28d49601381642a149a3ddaab73335.exe	28
PID 2044 wrote to memory of 2492	2044	4a28d49601381642a149a3ddaab73335.exe	28
PID 2044 wrote to memory of 2492	2044	4a28d49601381642a149a3ddaab73335.exe	28

C:\Users\Admin\AppData\Local\Temp\4a28d49601381642a149a3ddaab73335.exe
"C:\Users\Admin\AppData\Local\Temp\4a28d49601381642a149a3ddaab73335.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\auGx3V.log

Filesize
1KB

MD5
be7e9f72977f53b63e3da4e124e91182

SHA1
5a941811a95bc868cd695d37ae36da3a6e7b49cb

SHA256
f4c2aa13f3ea42d7e298aae963f27013f3634dd0124ca29a88944f303690619c

SHA512
66cabde6d1d22402c0d752ecba45037cbc083c52a85736741890915606ce1b5576695bb88ee57b3b796d7e1495047b87dc56b653d20e5c9986f7c619b9fd6b0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7CED.tmp

Filesize
40KB

MD5
313e16342df3b582bc22d57c3a8f8d28

SHA1
2ee8250037502ba807781e7545675f0cf1c332c7

SHA256
951af4a9a98dba93f849d9fc835ad5bc0f55ecc63415165838ebe9d47e70a53c

SHA512
374cb41997fbf5264a9a9256d85ae61fe2b01acf03cb25baf0e91ebebb597e249e37c4ec2076d2d4851c7299e75258f03e5fc155d544cb55926e5fe58eaa0222

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
8fac19973a8fe5df305fbc0c922bf171

SHA1
be346cc915061662e8f541de2f2876edd33d28a9

SHA256
323547fc588007a0456e7759d194b2b45e92ab19cc902e793d180f2a4e16ed95

SHA512
6585e5e003b189aae003b82fcf14e3c954d1ef9f76ca7f381ab127af5a236f8f8ea4e34e780be1f71418b350faf3a47936999e476a3c86da475985b23b3ecb58

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
f1d0abe86e4da9d356088ec4e01ae0ee

SHA1
0b3aa89c939d95ab9a46277da1bb3d9285b98f57

SHA256
126357f5794d907674ac801e8eb6da2ceb94c9bc6977c73b73bf97b83f738269

SHA512
342863f43093024e719736004ea8e0950ed8b56dc67014e3226359dec9e311b37813b32d28c705dce74d181e23a3f630f21f818e090ffef96ef8bdd2fa3f2df7

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2044-0-0x0000000000500000-0x000000000050D000-memory.dmp

Filesize
52KB

Download
memory/2044-7-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/2044-20-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/2044-23-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/2492-32-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2492-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2492-27-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2492-36-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2492-37-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2492-22-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2492-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2492-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2492-55-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2492-58-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2492-59-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2492-63-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2492-67-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2492-68-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2492-72-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2492-10-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads