1b1c21c22215e3c70f6e03558bf96c069629b4679dd19f2bde82a6bc600c7c28

General

Target

1b1c21c22215e3c70f6e03558bf96c069629b4679dd19f2bde82a6bc600c7c28.exe
Size

29KB
MD5

816c7d5f18cc3521ff861583dde20779
SHA1

b07bdea30a953f409797b22b3bc5bcce40e28c50
SHA256

1b1c21c22215e3c70f6e03558bf96c069629b4679dd19f2bde82a6bc600c7c28
SHA512

b40955c96b3e5308cca0799b7284bc402d492c6d1ebd304bd06eabf78ea9fc49f0dcb66b581684e074c7f82606f057e726b6100227932f5bcf7c2f77473220a0
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/T1:AEwVs+0jNDY1qi/qx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2108	services.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1084-2-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2108-11-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x000c000000014fe1-6.dat	upx
behavioral1/memory/1084-17-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2108-18-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2108-23-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2108-30-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2108-32-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2108-37-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2108-42-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1084-43-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2108-44-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2108-49-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x001000000000f680-59.dat	upx
behavioral1/memory/1084-69-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2108-70-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1084-71-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2108-72-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1084-76-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2108-77-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2108-82-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1084-83-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2108-84-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2108-89-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	1b1c21c22215e3c70f6e03558bf96c069629b4679dd19f2bde82a6bc600c7c28.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\java.exe	1b1c21c22215e3c70f6e03558bf96c069629b4679dd19f2bde82a6bc600c7c28.exe
File created	C:\Windows\java.exe	1b1c21c22215e3c70f6e03558bf96c069629b4679dd19f2bde82a6bc600c7c28.exe
File created	C:\Windows\services.exe	1b1c21c22215e3c70f6e03558bf96c069629b4679dd19f2bde82a6bc600c7c28.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 2108	1084	1b1c21c22215e3c70f6e03558bf96c069629b4679dd19f2bde82a6bc600c7c28.exe	28
PID 1084 wrote to memory of 2108	1084	1b1c21c22215e3c70f6e03558bf96c069629b4679dd19f2bde82a6bc600c7c28.exe	28
PID 1084 wrote to memory of 2108	1084	1b1c21c22215e3c70f6e03558bf96c069629b4679dd19f2bde82a6bc600c7c28.exe	28
PID 1084 wrote to memory of 2108	1084	1b1c21c22215e3c70f6e03558bf96c069629b4679dd19f2bde82a6bc600c7c28.exe	28

C:\Users\Admin\AppData\Local\Temp\1b1c21c22215e3c70f6e03558bf96c069629b4679dd19f2bde82a6bc600c7c28.exe
"C:\Users\Admin\AppData\Local\Temp\1b1c21c22215e3c70f6e03558bf96c069629b4679dd19f2bde82a6bc600c7c28.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpEAED.tmp

Filesize
29KB

MD5
d5607537cc697ed6788563ce78b75705

SHA1
ab039aad57bdb957edac77d1d43c85adf22c01e7

SHA256
be0c045312bf769d5bcf5dcb5e5ca8eb539bec2417fb7cf7f1187d1b7e16cf64

SHA512
15ac90eefd6af69f057beef930b8817ec02cce7e10e3684d797ad365ecceaf433f0f77aebb2f589d0d9a64728c7feef41c6d84e3894e638f11070e2ee89c7a91

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
f702515f446ef5ea8036bbe222dac8ee

SHA1
ec883559509c774d4aa51c71ac35ed98802c42c2

SHA256
9f485e674eb37e23e66783e46401da35c8b262c3e4115518929a9ff9d870dcf1

SHA512
e1a05bf0e5f68b40d58c985be5083c817af63df065e9832724bc80058084a2bc3160bb93f245a4ebbc86866edc8b0305af5543209da61a8b4b6ae59a11c806d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
c43236f6a8b6138d1152477498796175

SHA1
538652e8e100ffa524c04a98ccb3900b3ed2cab3

SHA256
0a9f37676ddcba14949d0ad2ee9ad90fd945bfe80e8c0a95ddec4cad5d99078f

SHA512
522063f595b2a02809741260b73edcc13ebc88f6ec853e5fe307fa071f16b4620e61c3122d6abf2c2defd4c84490870653acb50267b4a0dfe6fc1551a803a05e

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1084-17-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1084-10-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/1084-43-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1084-76-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1084-71-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1084-24-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/1084-25-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/1084-69-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1084-83-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1084-9-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/1084-2-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2108-42-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2108-44-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2108-49-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2108-37-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2108-32-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2108-30-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2108-70-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2108-23-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2108-72-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2108-18-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2108-77-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2108-82-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2108-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2108-84-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2108-89-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads