Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    01-07-2024 12:50

General

  • Target

    mail.com.exe

  • Size

    42KB

  • MD5

    17fbc834b7ce83e295cbb7601a5a9899

  • SHA1

    901b686e1ef9729764a1145da1979a7621cf850f

  • SHA256

    004589df86e90096a63c78045cc7e1c328ea3863e904572dea5a64e576969b2a

  • SHA512

    c722ab16c433e2af8de91118ef731fb6ee147d221cc7ed70a49cc2fb7db84b2138132ca7f213745274ca1e4940d468833a210c2608b19ab78eee4cf368d21570

  • SSDEEP

    768:tdAkXGqv1GypfcHrk1DqAHNS/BHPmeWcTeYdC9VOV0rxAdeV1:tdAkXGqECcwYgw9PNSa0GQ

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\mail.com.exe
    "C:\Users\Admin\AppData\Local\Temp\mail.com.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2928
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:3040

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1f916df4ac2de8197b92784120c07a0f

    SHA1

    08d6b4054bc65ae2b48d49941552692f17026cfb

    SHA256

    960505efcae00e3f5032bf4d9cec2e4bf78216eb476ef18c787abdbbaacc6a8e

    SHA512

    36215c9c7a012b2e964aa7fcd0f8620873d117134ae2ce4a560da899ad86d7e6544f9bf6f244adc7b9c103d663dd646897c0ced7df7b49de0db131bc96e579a8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f0fc093691359014eb685eba189b88fa

    SHA1

    39c9a4c5501cf503b14c5106668d991ec16f0e6c

    SHA256

    40a00caa766b0e54439290d48724b8f106e6e77c1918161665a7b18e67a5b980

    SHA512

    4b7f927ea31b366c7cf1699ce3a5e6a24f854ae635d7b2c3c2ef6af152ebe3df86690f0d7480c16238a4c52d3dd7f1bdb73a3e16b5d7059737138f400a853d31

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    aee93d32e4dbe056604f602565f7d1e7

    SHA1

    06edeb2daa8e9e063eaa57d870e75ab1678ddeb0

    SHA256

    16077dce93470b57693399ad1f679684d1f09aa371d266d49a74a93f95943cb8

    SHA512

    6c530915a316abde5b700cec95c020eb97458af4bc2f258be293fba06f88b6f5471dc4244a0b3881746b0c1b3189947962faf4d2567ba7774e5d2ef7c6c5c16e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    dddf02217db65d62975dbcd26f861cec

    SHA1

    1d5d7c939de1149bcc9c57b9cf41bcb1eaef42c9

    SHA256

    0a54eb0252f7f118b5d103eb41b64b99814bfdb3c144fdaac62ab0cf3f3fb9b3

    SHA512

    bf1a625d4e7e641f142a98275f8033cfb0533be7a4fb3b7997c36300a324b25347d5cde10509e12fb73d70b3a7ac6f90c51ba08ee273550a550155ba3720e7ff

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2XHJXO3H\search[2].htm

    Filesize

    198KB

    MD5

    e9a83c9d0432dcead5b5129d60aa32a0

    SHA1

    05dbd76e0a23cbd362d5dcdcee04c8bd3515a1bd

    SHA256

    a15759ba786faafadad929d8b2ed3b3a4035bcf06635dbc1eea17b265c6fa0e9

    SHA512

    33d8d156f5d78daf3b1dcab734328c68b6804c2bd9de8e175f8e26bab2f3e190e4ac256396d7fc1281b2526a9c4f5a0730c9fa02c5b9d214c5bdd5010f08a6fe

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H09CVCL3\1H5MT983.htm

    Filesize

    176KB

    MD5

    68c5ae5388dc84927547a7b1ce0302ee

    SHA1

    92f7b583247fa469b306c9abf576d2ad8e863581

    SHA256

    391e017704beb75af96272ed03c0996aa59324749154b8a39d2e921e44a30543

    SHA512

    0c6df60603ad67b14628dca727218ecbd9805df3b893dfca6d3ded2fcc9fa675b7c8616aba67ea047857f23a6767d0b66173e39a290aa7cf89d83687c200153c

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H09CVCL3\752DO4KN.htm

    Filesize

    176KB

    MD5

    c8e6e9a9b492ef1a9edf62a8322ba16b

    SHA1

    744e51969fa764666f293ffc730712fcb4f78940

    SHA256

    97884418aff1bdd4218f0084f42e21bae87e0a94e38bf39d6ec01a31e2741825

    SHA512

    5eb38b83f46c9c965389f2dbef61d529b7910db8a34eeb230afe388267d3509cfa0769d008fc64174644d0b1943107fcead36e76700d3eea18b9ae34467ec474

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H09CVCL3\search[2].htm

    Filesize

    25B

    MD5

    8ba61a16b71609a08bfa35bc213fce49

    SHA1

    8374dddcc6b2ede14b0ea00a5870a11b57ced33f

    SHA256

    6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

    SHA512

    5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

  • C:\Users\Admin\AppData\Local\Temp\Cab4A45.tmp

    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

  • C:\Users\Admin\AppData\Local\Temp\Cab4AC3.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar4B07.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\atbdeE.log

    Filesize

    64B

    MD5

    0cdec7b2d6f58d1c60938f7ab614dd06

    SHA1

    3cefee937e7ade84c8c6f204a23a1dc924cc0696

    SHA256

    efcf00f54aa93fce07a255d5011d8fc18ea7dee02e2a0d7004fb0f3bfad29695

    SHA512

    707e9f7fcb423812652c94837d38cc089b51ca42e00d303d77eed3600b862088814fbc620b27cb044e9203f9f82e27cffbe0af387efa65481f28e7204b91f92a

  • C:\Users\Admin\AppData\Local\Temp\tmp4C8D.tmp

    Filesize

    42KB

    MD5

    c8cd9d84fd442f13c12f10c27925aa9e

    SHA1

    a30b9806b2d1ad25f263b09df864d2d525738bcb

    SHA256

    b6c0347da892e9578a2321081e1b2cb57b87c59396a56ae296595dcfb7d318ce

    SHA512

    d6d3cc6c86620629953e12087ca145de63f1f1d28bac8830c9d493aab4fe024698714aab2eff5228aff6920f1392881661bf8bcb2373bd854d358192881698d5

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    96B

    MD5

    d8232cda5c93545c002970633208dd47

    SHA1

    983b4f847cd7b976c7434643f75c0d3d59bdab62

    SHA256

    83dd07006ea621826c051d827693e074bc4ab1102bb85c50b65eda68bb6d2de0

    SHA512

    36a886e9ff54e27b9763d2b8e2ead3ac554fddcd7dfdb0c21920f430f7dda72b42e947885faf75093881c7363a69ed66dcb70f603cae30f986a3b9ad1145da71

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    96B

    MD5

    ee35fb9a9b389c1f30b6bad211c8b0b5

    SHA1

    364148ff042974eabbeba02be9beee96bc12c854

    SHA256

    35a4ad2cd3911067c594085b4d0d0b408cfc0344282f561e0cafd691135888b1

    SHA512

    34c0fc29c1b8de78c73039331f7ef9c1c98289a7b488357e13a1f710a58098c3bcce3aee679ebf0f3fc674395c77b9f640cb5671214418d191d0839118c3bdc6

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/2928-0-0x0000000000500000-0x0000000000511000-memory.dmp

    Filesize

    68KB

  • memory/2928-22-0x00000000002A0000-0x00000000002A8000-memory.dmp

    Filesize

    32KB

  • memory/2928-10-0x00000000002A0000-0x00000000002A8000-memory.dmp

    Filesize

    32KB

  • memory/2928-4-0x00000000002A0000-0x00000000002A8000-memory.dmp

    Filesize

    32KB

  • memory/3040-26-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3040-70-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3040-74-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3040-69-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3040-65-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3040-61-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3040-60-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3040-57-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3040-36-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3040-35-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3040-31-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3040-27-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3040-21-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3040-17-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3040-11-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB