2499c608547bc875f53025ca4186444eee77f718a9f49d25833e3165b5032d7c

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2024 19:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2499c608547bc875f53025ca4186444eee77f718a9f49d25833e3165b5032d7c.exe
Size

28KB
MD5

11e77b67b06b359454edf371698ab345
SHA1

d5c472a97c99ddfb18f04eb9ecef176070431e66
SHA256

2499c608547bc875f53025ca4186444eee77f718a9f49d25833e3165b5032d7c
SHA512

af7fc0b455c3fc1062ec31182bf31ee1fe24cd0f473277d062a4452673e5262a57bfbff863132e212381b3e5f4f1f5e1fccff1bae51e1cd93bb15e65f99bbed4
SSDEEP

384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNs0mBL:Dv8IRRdsxq1DjJcqfb0I

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2816	services.exe

UPX packed file 28 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4876-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/files/0x00080000000233c9-4.dat	upx
behavioral2/memory/2816-7-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4876-13-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/2816-14-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2816-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2816-24-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2816-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4876-30-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/2816-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4876-35-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/2816-36-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x00090000000233de-46.dat	upx
behavioral2/memory/4876-109-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/2816-110-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4876-137-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/2816-138-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2816-142-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4876-143-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/2816-144-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4876-167-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/2816-168-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4876-208-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/2816-209-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4876-239-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/2816-240-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4876-274-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/2816-275-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	2499c608547bc875f53025ca4186444eee77f718a9f49d25833e3165b5032d7c.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	2499c608547bc875f53025ca4186444eee77f718a9f49d25833e3165b5032d7c.exe
File opened for modification	C:\Windows\java.exe	2499c608547bc875f53025ca4186444eee77f718a9f49d25833e3165b5032d7c.exe
File created	C:\Windows\java.exe	2499c608547bc875f53025ca4186444eee77f718a9f49d25833e3165b5032d7c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 2816	4876	2499c608547bc875f53025ca4186444eee77f718a9f49d25833e3165b5032d7c.exe	82
PID 4876 wrote to memory of 2816	4876	2499c608547bc875f53025ca4186444eee77f718a9f49d25833e3165b5032d7c.exe	82
PID 4876 wrote to memory of 2816	4876	2499c608547bc875f53025ca4186444eee77f718a9f49d25833e3165b5032d7c.exe	82

C:\Users\Admin\AppData\Local\Temp\2499c608547bc875f53025ca4186444eee77f718a9f49d25833e3165b5032d7c.exe
"C:\Users\Admin\AppData\Local\Temp\2499c608547bc875f53025ca4186444eee77f718a9f49d25833e3165b5032d7c.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3YK18YAR\defaultW7RA84SH.htm

Filesize
304B

MD5
cde2c6ec81201bdd39579745c69d502f

SHA1
e025748a7d4361b2803140ed0f0abda1797f5388

SHA256
a81000fc443c3c99e0e653cca135e16747e63bccebd5052ed64d7ae6f63f227f

SHA512
de5ca6169b2bb42a452ebd2f92c23bad3a98c01845a875336d6affe7f0192c2782b1f66f149019c0b880410c836fc45b2e9157dcccc7ad0d9e5953521a2151d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3YK18YAR\default[1].htm

Filesize
310B

MD5
2a8026547dafd0504845f41881ed3ab4

SHA1
bedb776ce5eb9d61e602562a926d0fe182d499db

SHA256
231fe7c979332b82ceccc3b3c0c2446bc2c3cab5c46fb7687c4bb579a8bba7ce

SHA512
1f6fa43fc0cf5cbdb22649a156f36914b2479a93d220bf0e23a32c086da46dd37e8f3a789e7a405abef0782e7b3151087d253c63c6cefcad10fd47c699fbcf97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6E1TJXL2\default[5].htm

Filesize
312B

MD5
c15952329e9cd008b41f979b6c76b9a2

SHA1
53c58cc742b5a0273df8d01ba2779a979c1ff967

SHA256
5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7

SHA512
6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6E1TJXL2\default[9].htm

Filesize
308B

MD5
5243568476eb2052b2f3b67dc9053e86

SHA1
b126aa6506772f9024b76580bdf28b45e3a7f051

SHA256
2d458622dc76eb87e44cc7db89309efdf50f99821145ae86864fd1b714cbaa80

SHA512
3c68cef4e3daa4bca6e8b3aa5a31874be1e4dec38fe9781c6fe4890980744527d0c6818eeb519f8e6b322118e1f08302d85972fa7da4ba8be9421aabf9a77833

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FEHPE754\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZURVPW13\default[2].htm

Filesize
305B

MD5
157431349a057954f4227efc1383ecad

SHA1
69ccc939e6b36aa1fabb96ad999540a5ab118c48

SHA256
8553409a8a3813197c474a95d9ae35630e2a67f8e6f9f33b3f39ef4c78a8bfac

SHA512
6405adcfa81b53980f448c489c1d13506d874d839925bffe5826479105cbf5ba194a7bdb93095585441c79c58de42f1dab1138b3d561011dc60f4b66d11e9284

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3C89.tmp

Filesize
28KB

MD5
9eda082c7cf02b6b8d5f851a4523f9db

SHA1
91bab61bfb11281440f5acebecc37449029b4389

SHA256
bbb41fdbeb22e2a34f4df3b80d80518d1189b9706f85da6b1f6d3c79ecadebad

SHA512
fee89221bb368078012ffe64122e77c2a424c79ab49bee20535f93da64f4794a5f438a3b35070f8bcac970277b2735d020cef77ed70dd7ce5a76a18ba760c45e

Download Submit
C:\Users\Admin\AppData\Local\Temp\uxclb.log

Filesize
1KB

MD5
9c3ccfd58b88a5ba4c9eb6365f4defd9

SHA1
5252a8f69062e5b79bdedfdb6c8082ab11c7ceed

SHA256
e0c7ed9d13890f7d0b5e83643a6a2767eb25c98ce3af3c9321188452394239ce

SHA512
f9f0efbecc11a6b167df61ff192fbac9edf0716f93032e357a0b694057287b329699060bb79ba5d774ae9def9f47d488dd9f3c5051157126f511b728115439ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
45d92b306a572d8e97130d865e38645b

SHA1
69a730045f69004d3cc62510960d727ff6601c7c

SHA256
5c4ea61017e62a0c236a0e0d94833896d1a3b6c750f5ae041b45212c4895e1b0

SHA512
ae4e23e956b4333874c5133796fbc64f455e00fad750ae2a2e9de60193876549bb05e7f283a7c311c68b73f7c363257d2d67a382027042f8a0804533da17251f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
2784337404d79a56ce1522b7a6cea936

SHA1
1cecf2dcd5017c16df9c1df8b8d104221c4ea890

SHA256
9b1ece6c914cd82604fb44cd5966c39861425e17c63e837d99becd34e4b18ba2

SHA512
61150a90c332f0d821aae77f393448b3d90ec8cd04e8d402c1d46c4633ed52ec91752fcbfc6e8501bd256dc55376078bcf1196228b794ef74dc24d20bf898efc

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
650ae2878b8f55fe2d330819880c9f9a

SHA1
8f41d1e5fab0c6f0d310faa65d2c09bdf20d964a

SHA256
5722d0bf9dab3614cbdaa53f1d117e76bc20dc2fecdbb1c1cd753820859da60d

SHA512
4906e6d06f8ac1c0a24a1d37045b9d797cab64b647afe326b0d9f4331832de161f8c9ef12e76d5acea3411b4ecccde2a80547685122aedb0ef3385f97270fced

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2816-168-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2816-240-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2816-7-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2816-110-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2816-275-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2816-31-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2816-14-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2816-24-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2816-138-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2816-142-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2816-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2816-144-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2816-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2816-36-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2816-209-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4876-167-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4876-208-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4876-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4876-143-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4876-239-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4876-137-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4876-30-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4876-274-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4876-35-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4876-13-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4876-109-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads