875e70d75af9f9b9793f5750c1f72a567bf04f5f90d0b9181b22adee71b64765

General

Target

e59c10ac40ed4a3303ee92e1df7644d7.exe
Size

29KB
MD5

e59c10ac40ed4a3303ee92e1df7644d7
SHA1

aa22bb25477048c28d281c7a88f930daef31af56
SHA256

875e70d75af9f9b9793f5750c1f72a567bf04f5f90d0b9181b22adee71b64765
SHA512

90811fccd5ba44643b988345ef29008c88a5ad7ce278a81aa8c66b5651e6b8370b741c4c884572abd06d1389adc1da0f51cc4d11cd98b836dfd50d5ea35237ed
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/p:AEwVs+0jNDY1qi/qR

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2860	services.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2872-4-0x00000000001B0000-0x00000000001B8000-memory.dmp	upx
behavioral1/memory/2872-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2860-12-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x001000000000b1f5-9.dat	upx
behavioral1/memory/2860-18-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2872-17-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2860-23-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2860-25-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2860-27-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2860-32-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2860-37-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2860-39-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2860-44-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2860-49-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2860-51-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2860-56-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2860-61-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2860-63-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2872-62-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2860-68-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x0033000000015c83-81.dat	upx
behavioral1/memory/2860-90-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2872-89-0x0000000000500000-0x0000000000510200-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	e59c10ac40ed4a3303ee92e1df7644d7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	e59c10ac40ed4a3303ee92e1df7644d7.exe
File opened for modification	C:\Windows\java.exe	e59c10ac40ed4a3303ee92e1df7644d7.exe
File created	C:\Windows\java.exe	e59c10ac40ed4a3303ee92e1df7644d7.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2860	2872	e59c10ac40ed4a3303ee92e1df7644d7.exe	16
PID 2872 wrote to memory of 2860	2872	e59c10ac40ed4a3303ee92e1df7644d7.exe	16
PID 2872 wrote to memory of 2860	2872	e59c10ac40ed4a3303ee92e1df7644d7.exe	16
PID 2872 wrote to memory of 2860	2872	e59c10ac40ed4a3303ee92e1df7644d7.exe	16

C:\Users\Admin\AppData\Local\Temp\e59c10ac40ed4a3303ee92e1df7644d7.exe
"C:\Users\Admin\AppData\Local\Temp\e59c10ac40ed4a3303ee92e1df7644d7.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp96A6.tmp

Filesize
25KB

MD5
3ad30bc888fc104e77e7cc43d93fd427

SHA1
cc107f2ea86011fce79f6b1d84bed31bef9ee1cb

SHA256
69b721d054fc49f7a4b2554429c766d8eb4a4ab4005d57eef32950a2b293c9ef

SHA512
695898677ed20daa732eb1695a52344b2d3199f400c55b80f79757aecff7fd78fb5b1682a72cfaec87758a15322be1f8862039317fe4ac0d058cf25961c52474

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
3475c1cc2fe534f7eccdc1b5cadf64b0

SHA1
17977646a8191b59a56b4839e7ce644c3c80f4a2

SHA256
3ceca04a30143ce678c833887486fe027ad55cfa4beed0e265c33a9d53345600

SHA512
148106ef08a978710043267fc7ed818b66683fe9563a69d588f00e5463f63532e65944b520a2001272b9d84ed7fd1809be526a4316add883fc87739891b19ba8

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2860-32-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2860-63-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2860-18-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2860-90-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2860-23-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2860-25-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2860-12-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2860-27-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2860-68-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2860-37-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2860-39-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2860-44-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2860-49-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2860-51-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2860-56-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2860-61-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2872-10-0x00000000001B0000-0x00000000001B8000-memory.dmp

Filesize
32KB

Download
memory/2872-62-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2872-4-0x00000000001B0000-0x00000000001B8000-memory.dmp

Filesize
32KB

Download
memory/2872-24-0x00000000001B0000-0x00000000001B8000-memory.dmp

Filesize
32KB

Download
memory/2872-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2872-17-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2872-89-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads