4e811d4be34b5de7e2561be12d77857d12755aac007d9effd19e5a574efe8dd4

General

Target

4e811d4be34b5de7e2561be12d77857d12755aac007d9effd19e5a574efe8dd4.exe
Size

240KB
MD5

68b61e23d7a30cf67030cb25c52784cb
SHA1

38778ef76f1010f40ce70f40504140bb2652a064
SHA256

4e811d4be34b5de7e2561be12d77857d12755aac007d9effd19e5a574efe8dd4
SHA512

6597a072e56dbb972017e80ae0d1cbd4d764c3022c89a3bdc5ce0bda9a22d97e04b3d37ccc01fd1ce499bf301962d972d411253e872d7c2c7287e3a0fab8c3c8
SSDEEP

3072:hfAIuZAIuYSMjoqtMHfhfSE9tHpKrvGCLOwstyhZFChcssc56FUrgxvbSD4UQrOf:hfAIuZAIuDMVtM/D95pK7ShcHUae

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (1356) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1836-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
C:\Windows\SysWOW64\Zombie.exe	UPX
C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.exe	UPX
behavioral2/memory/1836-24-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

Executes dropped EXE 2 IoCs

Processes:

Zombie.exe_clist.exe

pid process

336 Zombie.exe
1116 _clist.exe

pid	process
336	Zombie.exe
1116	_clist.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1836-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\Windows\SysWOW64\Zombie.exe	upx
C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.exe	upx
behavioral2/memory/1836-24-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

Processes:

4e811d4be34b5de7e2561be12d77857d12755aac007d9effd19e5a574efe8dd4.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Zombie.exe	4e811d4be34b5de7e2561be12d77857d12755aac007d9effd19e5a574efe8dd4.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	4e811d4be34b5de7e2561be12d77857d12755aac007d9effd19e5a574efe8dd4.exe

Drops file in Program Files directory 64 IoCs

Processes:

Zombie.exe

description	ioc	process
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Primitives.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.SecureString.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\UIAutomationClient.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\fi.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\ConvertFormat.html.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Globalization.Calendars.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.NetworkInformation.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\System.Windows.Forms.Primitives.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.OpenSsl.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\UIAutomationClient.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\UIAutomationProvider.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\Microsoft.Win32.Primitives.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.WebProxy.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\PresentationUI.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\UIAutomationProvider.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Console.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.WebClient.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.Csp.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework-SystemData.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\System.Windows.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Drawing.Primitives.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-datetime-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\PresentationCore.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework.AeroLite.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Data.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\System.Windows.Input.Manipulations.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Tasks.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\System.Windows.Forms.Primitives.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TabTip.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-interlocked-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Numerics.Vectors.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\ReachFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\ReachFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\UIAutomationProvider.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\PresentationUI.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\PresentationCore.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\ReachFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ServiceProcess.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Pipes.dll.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

4e811d4be34b5de7e2561be12d77857d12755aac007d9effd19e5a574efe8dd4.exe

description	pid	process	target process
PID 1836 wrote to memory of 336	1836	4e811d4be34b5de7e2561be12d77857d12755aac007d9effd19e5a574efe8dd4.exe	Zombie.exe
PID 1836 wrote to memory of 336	1836	4e811d4be34b5de7e2561be12d77857d12755aac007d9effd19e5a574efe8dd4.exe	Zombie.exe
PID 1836 wrote to memory of 336	1836	4e811d4be34b5de7e2561be12d77857d12755aac007d9effd19e5a574efe8dd4.exe	Zombie.exe
PID 1836 wrote to memory of 1116	1836	4e811d4be34b5de7e2561be12d77857d12755aac007d9effd19e5a574efe8dd4.exe	_clist.exe
PID 1836 wrote to memory of 1116	1836	4e811d4be34b5de7e2561be12d77857d12755aac007d9effd19e5a574efe8dd4.exe	_clist.exe

C:\Users\Admin\AppData\Local\Temp\4e811d4be34b5de7e2561be12d77857d12755aac007d9effd19e5a574efe8dd4.exe
"C:\Users\Admin\AppData\Local\Temp\4e811d4be34b5de7e2561be12d77857d12755aac007d9effd19e5a574efe8dd4.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1836

C:\Users\Admin\AppData\Local\Temp\_clist.exe
"_clist.exe"
2⤵
- Executes dropped EXE
PID:1116

C:\Windows\SysWOW64\Zombie.exe
"C:\Windows\system32\Zombie.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4832 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:4000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.exe
Filesize
97KB

MD5
61cb624f2f4fd6d9a3dcb6b370bfba84

SHA1
35936c6436d71a6a086e69881b9d693214687291

SHA256
09560463fb02148e77f635bae7b55863b9b1ca3e89ab9d5311432ff73cc5b61e

SHA512
ba363d99d9e4f9a2a992e8e5ee91ca0ef5aebeb1d212c0a781196266a1a39203abcd2b8c9549d297acf8ee59a9a2cc792e2daa6caed41d8f3ebed8e60432a3f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_clist.exe
Filesize
143KB

MD5
b27ea830fb39bc056e65f9a2260ae216

SHA1
b69e40ee5cabe0721d2d1e9fbdd4088fd87592d6

SHA256
fb7fab836f744d669451dcd38aa7d2a9c74c6af893c258d079439b58abce70d8

SHA512
22cad79d90a949174828ee5e3ce621113591c7c991c55c1a6a44a4555002adeb3bcbd9bab6cfbbfdefd663b76ac2dae96d70a01c527b312c7e8d223334a30219

Download Submit
C:\Windows\SysWOW64\Zombie.exe
Filesize
97KB

MD5
cd05396584f2691216469104dbd20454

SHA1
c952987f07e48337d34c4fa93df20881a7c83a5a

SHA256
281edf7d3e876ce4b6fee6f0451a738c3dde9f2357122d6a9f202ee08d23303d

SHA512
6081239849e1caa29ed6e1cb741ee343dfd6c11597cff1736a7720cf317de44eede2f739a04cd877e1a829af7fccdae9387aa8549c790fabdefc4f59be9ecd2c

Download Submit
memory/1116-20-0x00007FFC22ED3000-0x00007FFC22ED5000-memory.dmp

Filesize
8KB

Download
memory/1116-21-0x0000000000100000-0x0000000000128000-memory.dmp

Filesize
160KB

Download
memory/1836-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1836-24-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads