dc6fe8d6d2e46152078b896e79d865735b0829fd370c9ee42aa04c8892a3d5e8

General

Target

dc6fe8d6d2e46152078b896e79d865735b0829fd370c9ee42aa04c8892a3d5e8.exe
Size

29KB
MD5

5eacd392fdcb1f3e98bbaf113bf8bfaf
SHA1

c38a26c091180acad3dddff9c9e9bb6361a423b6
SHA256

dc6fe8d6d2e46152078b896e79d865735b0829fd370c9ee42aa04c8892a3d5e8
SHA512

59c203f8e3047f853ed72f4f6ddd5dc48fe38b8b1f796900842493eebc69e381488cad3ed4d7ac7b293510376166e7cb732ac3a96f0dfacbcad80ef19fe5637c
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/+:AEwVs+0jNDY1qi/q2

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

services.exe

pid process

1332 services.exe

pid	process
1332	services.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2052-2-0x0000000000500000-0x0000000000510200-memory.dmp	upx
C:\Windows\services.exe	upx
behavioral1/memory/2052-4-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1332-10-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2052-16-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1332-17-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1332-22-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1332-24-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1332-29-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1332-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1332-36-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1332-41-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1332-43-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1332-48-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1332-53-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2052-54-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1332-55-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1332-60-0x0000000000400000-0x0000000000408000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\tmp4108.tmp	upx
behavioral1/memory/2052-80-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1332-81-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2052-82-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1332-83-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2052-87-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1332-88-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

dc6fe8d6d2e46152078b896e79d865735b0829fd370c9ee42aa04c8892a3d5e8.exeservices.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	dc6fe8d6d2e46152078b896e79d865735b0829fd370c9ee42aa04c8892a3d5e8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

Processes:

dc6fe8d6d2e46152078b896e79d865735b0829fd370c9ee42aa04c8892a3d5e8.exe

description	ioc	process
File created	C:\Windows\services.exe	dc6fe8d6d2e46152078b896e79d865735b0829fd370c9ee42aa04c8892a3d5e8.exe
File opened for modification	C:\Windows\java.exe	dc6fe8d6d2e46152078b896e79d865735b0829fd370c9ee42aa04c8892a3d5e8.exe
File created	C:\Windows\java.exe	dc6fe8d6d2e46152078b896e79d865735b0829fd370c9ee42aa04c8892a3d5e8.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

dc6fe8d6d2e46152078b896e79d865735b0829fd370c9ee42aa04c8892a3d5e8.exe

description	pid	process	target process
PID 2052 wrote to memory of 1332	2052	dc6fe8d6d2e46152078b896e79d865735b0829fd370c9ee42aa04c8892a3d5e8.exe	services.exe
PID 2052 wrote to memory of 1332	2052	dc6fe8d6d2e46152078b896e79d865735b0829fd370c9ee42aa04c8892a3d5e8.exe	services.exe
PID 2052 wrote to memory of 1332	2052	dc6fe8d6d2e46152078b896e79d865735b0829fd370c9ee42aa04c8892a3d5e8.exe	services.exe
PID 2052 wrote to memory of 1332	2052	dc6fe8d6d2e46152078b896e79d865735b0829fd370c9ee42aa04c8892a3d5e8.exe	services.exe

C:\Users\Admin\AppData\Local\Temp\dc6fe8d6d2e46152078b896e79d865735b0829fd370c9ee42aa04c8892a3d5e8.exe
"C:\Users\Admin\AppData\Local\Temp\dc6fe8d6d2e46152078b896e79d865735b0829fd370c9ee42aa04c8892a3d5e8.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2052

C:\Windows\services.exe
"C:\Windows\services.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1332

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4108.tmp
Filesize
29KB

MD5
fdb385b817e509128b75b9b8ae7b693f

SHA1
20bafed9bc6e842f8e202f39d2ee0462f99c07e2

SHA256
444515060c60b310dff3ea8ac141f7a48193627866842c6171403996f2a94623

SHA512
e35c501d53497367d503c30fadaa9fd7c0a68fcd818ffe1ec025e1609931ff0aabdfcd0b5538902502b4d247868a5adb98d37f5fae818d0b31b6be0231797f01

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
352B

MD5
f0cef8d66b6ea48124c47c90c9985cf4

SHA1
174a6802aea68064f64300a5111ca0f444ec585f

SHA256
1b4fdcd3918762cb1213c8c4e8e7a3c5bf0c23f4ca709936ede404104475012e

SHA512
f487d6cee9bb7d49f14a4f2c9b3213314c94295274713285cd2d416bdb0362094f3daac1a1465c142594227975f08377e6f62e21cd71d312c8987ec5c4361102

Download Submit
C:\Windows\services.exe
Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1332-22-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1332-48-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1332-17-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1332-88-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1332-24-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1332-83-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1332-29-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1332-31-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1332-36-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1332-41-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1332-43-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1332-81-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1332-53-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1332-10-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1332-55-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1332-60-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2052-54-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2052-4-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2052-80-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2052-16-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2052-82-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2052-23-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2052-87-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2052-2-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads