5f692450b19428d86c02c50e8fbe8f6abf5a17658bfbdb3ffb407211f0ddd76b

General

Target

c1d03a69c44fed2bd909bf1139d8ecb7.exe
Size

40KB
MD5

c1d03a69c44fed2bd909bf1139d8ecb7
SHA1

c1bd9d7ed84a513a343a1bc68c905f3e95ebba46
SHA256

5f692450b19428d86c02c50e8fbe8f6abf5a17658bfbdb3ffb407211f0ddd76b
SHA512

c5ce1dc02c9488e95d548ad79b62fae6574db6af1512941b7d845bace061a48eb6f054356d8f101db9aaaee2bb302bf191d3717f76a5ea44894e113b20f773e6
SSDEEP

768:aq9m/ZsybSg2ts4L3RLc/qjhsKmHbk1+qJ0UtHSm06:aqk/Zdic/qjh8w19JDHw6

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2732	services.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023202-4.dat	upx
behavioral2/memory/2732-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2732-13-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2732-17-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2732-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2732-22-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2732-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2732-30-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2732-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2732-35-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2732-39-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2732-137-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2732-165-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2732-168-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2732-169-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2732-193-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	c1d03a69c44fed2bd909bf1139d8ecb7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\java.exe	c1d03a69c44fed2bd909bf1139d8ecb7.exe
File created	C:\Windows\services.exe	c1d03a69c44fed2bd909bf1139d8ecb7.exe
File opened for modification	C:\Windows\java.exe	c1d03a69c44fed2bd909bf1139d8ecb7.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 2732	4380	c1d03a69c44fed2bd909bf1139d8ecb7.exe	88
PID 4380 wrote to memory of 2732	4380	c1d03a69c44fed2bd909bf1139d8ecb7.exe	88
PID 4380 wrote to memory of 2732	4380	c1d03a69c44fed2bd909bf1139d8ecb7.exe	88

C:\Users\Admin\AppData\Local\Temp\c1d03a69c44fed2bd909bf1139d8ecb7.exe
"C:\Users\Admin\AppData\Local\Temp\c1d03a69c44fed2bd909bf1139d8ecb7.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AM4E1863\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC2E1.tmp

Filesize
40KB

MD5
31c1cf4a14ec721a65878fd47bffbf31

SHA1
4fe79153e18b0fe6f7e93c92f0ce76db7a948fbd

SHA256
684ccb0b13d4098a0e49f2feb506b4014cba435bfcc1709dfff2513e0daf3b90

SHA512
ee41675cf879cc1637f9afd711d6815cd7b941b891043be0f08be72471505b50bf4541a165d57b7e287ec24a949e1a9c28f0d0c1273cd04fd0007b8552e22383

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
8cda01386a005ec47a14272a00a8fae6

SHA1
5ca229dc48234bc94cb9c92d65f6261adf71fb81

SHA256
b10711c620c2ecd846fff1a1284e34e6d9978fee0ad571e17231515f6cb7ce3d

SHA512
89873ee85363f5efcbe385a0516ffd8675bc7591e95fa6ecb7cf4d085eaac5678220972f223111ab779fe6e61214a2d534bc5bcd04937c83efcf0d2bbe1cb5a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
fcb2ea3b9d7ea09b46b9777e51331ec5

SHA1
37118689df2e75b173d0be9a24bfd282dd454f69

SHA256
e80366056f9d6bf580145cdd5bb9509db811bbffe3358f9db06be857f0466135

SHA512
b7b4c8f94e893d6139af674ddba97f9e458baddbd648d5e17ce2764cab39a38421c18b5a181660af2d8912e30d2ebd5243ff7da4ef38916128f9146bfe80ea0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
48e9cff89aa3626004ebc4a0a1fad8ab

SHA1
b834b8bf87737f7d8adb5929576c9b4a3efea289

SHA256
87680b7b827161c774af62800cc59d5b6484381caaba9c1c925886c88b901bc4

SHA512
90c27ae7de3310a14b0ee3425bd4e26a7edc2fe18a6ae50a5ef0a476191bf7e64089b3bbc14ab06e4ee689a7a8fd9dc3f8fede6b029cca5bbdd9d2697076f183

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2732-17-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2732-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2732-30-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2732-31-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2732-35-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2732-39-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2732-22-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2732-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2732-193-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2732-137-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2732-13-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2732-165-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2732-168-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2732-169-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2732-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4380-0-0x0000000000500000-0x000000000050D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads