a903565a2e93c0d356419e0c222417b62e5c7296529a98f7073a094a13a1dbb5

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9ae0a1b508ca599c5dda97c85c720ad0_NeikiAnalytics.exe
Size 41KB
Sample240614-ctep8awamn
SHA256 a903565a2e93c0d356419e0c222417b62e5c7296529a98f7073a094a13a1dbb5
MD5 9ae0a1b508ca599c5dda97c85c720ad0
SHA1 0a64a9f288fdd8168b9dcf280bd468c8102bb015
SHA512 d8d2082aeda04b0aadab4da53c1386a76be21e4dbc1c6fa3873e4c2cbf63922fab2fe61ee708a18770ad0e84c03a6f327de60664a7c31ca97f8626513e629492
SSDEEP 768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1916	services.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2392-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2392-4-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x00090000000143ec-9.dat	upx
behavioral1/memory/1916-11-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2392-17-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1916-18-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1916-23-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1916-29-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1916-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1916-36-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1916-41-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1916-43-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1916-48-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1916-53-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1916-55-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x0006000000005a59-60.dat	upx
behavioral1/memory/2392-303-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1916-304-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2392-444-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1916-445-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2392-446-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1916-447-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2392-451-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1916-452-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	9ae0a1b508ca599c5dda97c85c720ad0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\java.exe	9ae0a1b508ca599c5dda97c85c720ad0_NeikiAnalytics.exe
File created	C:\Windows\services.exe	9ae0a1b508ca599c5dda97c85c720ad0_NeikiAnalytics.exe
File opened for modification	C:\Windows\java.exe	9ae0a1b508ca599c5dda97c85c720ad0_NeikiAnalytics.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	9ae0a1b508ca599c5dda97c85c720ad0_NeikiAnalytics.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	9ae0a1b508ca599c5dda97c85c720ad0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	9ae0a1b508ca599c5dda97c85c720ad0_NeikiAnalytics.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	9ae0a1b508ca599c5dda97c85c720ad0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 1916	2392	9ae0a1b508ca599c5dda97c85c720ad0_NeikiAnalytics.exe	28
PID 2392 wrote to memory of 1916	2392	9ae0a1b508ca599c5dda97c85c720ad0_NeikiAnalytics.exe	28
PID 2392 wrote to memory of 1916	2392	9ae0a1b508ca599c5dda97c85c720ad0_NeikiAnalytics.exe	28
PID 2392 wrote to memory of 1916	2392	9ae0a1b508ca599c5dda97c85c720ad0_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\9ae0a1b508ca599c5dda97c85c720ad0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9ae0a1b508ca599c5dda97c85c720ad0_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F0ACCF77CDCBFF39F6191887F6D2D357

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Size 1KB
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 7c76510de1d92f6a03176686422dcf45ae3bebc3611b136042604a65cdcf0a91
MD5 85d11161ec1490e847eb38ee3a0dbc02
SHA1 bbc464bb6162d67439a1ca50eefa7388258a6892
SHA512 fa9e8b59f52181cce279973ae014974db6a68b8e10911c3c6b897b79dfa17320997cb0bc0cfddba937f83ae54142e15a88416229f67920f8d2ec9e5d7504381e
MD5 SHA1 SHA512

Submit Download

F0ACCF77CDCBFF39F6191887F6D2D357

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Size 242B
SHA256 bc147ae4697c354a3c45ec601910272f8507653a1618209d2ec32b72250410cf
MD5 6a5b4a8a7639a31090b36783a0aec6fb
SHA1 73d94253721e5cec3a7d6c187d7236499509fe75
SHA512 eeb957ea8582a980c56c2149ac7ffaface82d5aba961d109a825a8e178ca5d4ae7ec958ca335ff860e4e1b7a9c8363b80ae360803bdcc6dd7d2d8cf5fc2ad226
MD5 SHA1 SHA512

Submit Download

1MF9EOO0.htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4HF8RAMX\1MF9EOO0.htm
Size 185KB
SHA256 998806b94296f599d4d95f8f88e1b6e533b66e848922b76b420f9712144b7c0e
MD5 e8fdabb182ebb5f2d46084030abcb4e8
SHA1 dca3eec5109aaf4e60ae56ab02974d20da4027e7
SHA512 78381eeb11b4eef1e941bcd848005d313f6defeb082a9d7bfac492f70b208aae40913cd5786404f5dd66ed2c4d7429532aaaf003cd8fc11b63e210ae09603192
SSDEEP 3072:M8IeGAzVCbS0ZK+QG58TJL9IetIeH4RKwT:MxAES0ZK+Qp2
MD5 SHA1 SHA512 SSDEEP

Submit Download

results[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8W7ZHWC9\results[1].htm
Size 1KB
SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
MD5 211da0345fa466aa8dbde830c83c19f8
SHA1 779ece4d54a099274b2814a9780000ba49af1b81
SHA512 37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca
MD5 SHA1 SHA512

Submit Download

search[2].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ETTWYYO0\search[2].htm
Size 132KB
SHA256 c38bc702bd27c2027b1255402fb55a49eccf53222156a6b3bcb79bf7237717cd
MD5 6a702bcaa30e927998c3016718bee33f
SHA1 56188b66a9883dcaada5d8208806171d463d546d
SHA512 fd1f56cf9424bb48dbfb5e903a6b63447e30f964bb5cb45c03b81c9a92c161cc7a5b682326f292e9ff6d5c234190cec061790b562f4b21cf113585c0936eacf6
SSDEEP 3072:hWIeQnFDlHDbQ9QYnjpvQa5ZHe8q8Y8G87818c8A+rGRkP:h3FsHFDgC5Jrgg
MD5 SHA1 SHA512 SSDEEP

Submit Download

search[3].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NK52PZFL\search[3].htm
Size 25B
SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
MD5 8ba61a16b71609a08bfa35bc213fce49
SHA1 8374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA512 5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
MD5 SHA1 SHA512

Submit Download

Cab9E56.tmp

Path C:\Users\Admin\AppData\Local\Temp\Cab9E56.tmp
Size 70KB
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar9FB2.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar9FB2.tmp
Size 181KB
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp94E0.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp94E0.tmp
Size 41KB
SHA256 b79f8c95584da7cecafe4c7a7d2bca269c87cb561990d34bbe8e17a46463e6e2
MD5 aa362c110d7c4f8d2c3d5941783dff4a
SHA1 82a2d3a9b7e786135fb2a49a1afb917099345a6a
SHA512 f4f46b9490e5c28c0e7fc76e12f2f7303f82c25425deabdf190a9a9874f00bf10a68d3e08a1d1f657e0dd0598ea2ea2385e8223e82ee1fcb09e249b96b743a33
SSDEEP 768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q
MD5 SHA1 SHA512 SSDEEP

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 160B
SHA256 81951042c8ef0ee559fcc7c256ee3ff5a4682136761e145f943936959a1012fa
MD5 14708a22312e282151f69d22763ee9ca
SHA1 d9e0ebbc7a952c4e411b7c802140f2b156b36440
SHA512 d10179f9ea4d5fffe364574b98a268c6ef01bc603010344903eb067002fb231b4aab1d9d0c049cf986c9d0378995443f27821ddc87a49664e82f878a0f2ec653
MD5 SHA1 SHA512

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 160B
SHA256 16244227f1b70fde661754a65d73ffdfb72954e7b21a78df2ede73e40c3489b1
MD5 46942a818028d8dc4c70e4623cf048a1
SHA1 7928fd511e3335af448720c487b441db2123c993
SHA512 7d1a826b3a5c668d2be45cf4b9050fced97ca7a537dfb69664fb3ae97b4355eddc31741b24e9e03735bf1d31b39b175e1ba4283681553b5a66b7617089ce5ffd
MD5 SHA1 SHA512

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 160B
SHA256 7c7c3828abe6d4fe31684d34dce841d59d7fe096614285212576da1e64807595
MD5 7fbfa6d7b78467678a8e8df81291f2d5
SHA1 fe082c1a88ee7612d59d6cd3b1b5ca0d325bba5a
SHA512 182d519efefb2d78464313f918046b83536759a502d998086f543302400b997dc7b9a83d8fb7db3c5e726570f6da173c54e98180a92858341645c6a7bdb6ac53
MD5 SHA1 SHA512

Submit Download

services.exe

Path C:\Windows\services.exe
Size 8KB
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
SSDEEP 192:tZWNqWKIzebvOZnzCj6juhEJS3/Uf/tpfmG62X9f3:tZ6qWTYvczfahX/UHtF6e9f3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1916-29-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1916-18-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1916-55-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1916-452-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1916-41-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1916-36-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1916-53-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1916-447-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1916-31-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1916-23-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1916-11-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1916-43-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1916-445-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1916-48-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1916-304-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2392-17-0x0000000000500000-0x0000000000510200-memory.dmp

Download

memory/2392-303-0x0000000000500000-0x0000000000510200-memory.dmp

Download

memory/2392-444-0x0000000000500000-0x0000000000510200-memory.dmp

Download

memory/2392-10-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2392-446-0x0000000000500000-0x0000000000510200-memory.dmp

Download

memory/2392-24-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2392-451-0x0000000000500000-0x0000000000510200-memory.dmp

Download

memory/2392-0-0x0000000000500000-0x0000000000510200-memory.dmp

Download

memory/2392-4-0x0000000000400000-0x0000000000408000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads