2b0cc6b8f9bbcc11dc232ba9c988994b04530429ad12a1c0acc0080f38a08bde

General

Target

2b0cc6b8f9bbcc11dc232ba9c988994b04530429ad12a1c0acc0080f38a08bde.exe
Size

41KB
MD5

6e4fb4b95491276e9b11df26536c0960
SHA1

d18f2396c57bb2d4121aa25ec08ba1f2d67e61fc
SHA256

2b0cc6b8f9bbcc11dc232ba9c988994b04530429ad12a1c0acc0080f38a08bde
SHA512

07330a35804aaa0b4eaf5d2bae68e57c578d42ce53a14638ee40a93050b935fd9ccb3e6f1c94e0be6f9f195fd57693f45f94beb76cb4b1d12f222d2591626042
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/u:AEwVs+0jNDY1qi/q

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1288	services.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2444-2-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1288-11-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x000a00000001471a-8.dat	upx
behavioral1/memory/2444-17-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1288-18-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1288-23-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1288-30-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1288-32-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1288-37-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1288-42-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1288-44-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2444-48-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1288-49-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1288-54-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2444-55-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1288-56-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2444-60-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1288-61-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2444-65-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1288-66-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1288-68-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2444-72-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1288-73-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	2b0cc6b8f9bbcc11dc232ba9c988994b04530429ad12a1c0acc0080f38a08bde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\java.exe	2b0cc6b8f9bbcc11dc232ba9c988994b04530429ad12a1c0acc0080f38a08bde.exe
File created	C:\Windows\java.exe	2b0cc6b8f9bbcc11dc232ba9c988994b04530429ad12a1c0acc0080f38a08bde.exe
File created	C:\Windows\services.exe	2b0cc6b8f9bbcc11dc232ba9c988994b04530429ad12a1c0acc0080f38a08bde.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 1288	2444	2b0cc6b8f9bbcc11dc232ba9c988994b04530429ad12a1c0acc0080f38a08bde.exe	28
PID 2444 wrote to memory of 1288	2444	2b0cc6b8f9bbcc11dc232ba9c988994b04530429ad12a1c0acc0080f38a08bde.exe	28
PID 2444 wrote to memory of 1288	2444	2b0cc6b8f9bbcc11dc232ba9c988994b04530429ad12a1c0acc0080f38a08bde.exe	28
PID 2444 wrote to memory of 1288	2444	2b0cc6b8f9bbcc11dc232ba9c988994b04530429ad12a1c0acc0080f38a08bde.exe	28

C:\Users\Admin\AppData\Local\Temp\2b0cc6b8f9bbcc11dc232ba9c988994b04530429ad12a1c0acc0080f38a08bde.exe
"C:\Users\Admin\AppData\Local\Temp\2b0cc6b8f9bbcc11dc232ba9c988994b04530429ad12a1c0acc0080f38a08bde.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dnWozue.log

Filesize
128B

MD5
5683b08710c88c22f2a9254259597460

SHA1
3849f2ca65d905ff27682fc0a0c1194b8b842e02

SHA256
c293d0797f70809421b3eeca39d5a8925277539cabc9c22b2e50e2e02ab62dc4

SHA512
e2718ab494c7d62c0f0e2653f107f2cc835bf88ccfb16cc4fba9d401850de1707af5ac213008b8317175ae74078c6552038560abec5f05fd41b20cf5547520c3

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1288-42-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1288-61-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1288-73-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1288-68-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1288-18-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1288-23-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1288-66-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1288-49-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1288-30-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1288-32-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1288-37-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1288-56-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1288-44-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1288-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1288-54-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2444-25-0x00000000001B0000-0x00000000001B8000-memory.dmp

Filesize
32KB

Download
memory/2444-48-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2444-55-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2444-2-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2444-60-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2444-9-0x00000000001B0000-0x00000000001B8000-memory.dmp

Filesize
32KB

Download
memory/2444-65-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2444-24-0x00000000001B0000-0x00000000001B8000-memory.dmp

Filesize
32KB

Download
memory/2444-17-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2444-72-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2444-10-0x00000000001B0000-0x00000000001B8000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads