Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
04/07/2024, 03:11
General
- Target c0375f5535c86d8dd8b517da3b8802695905a8b3ea817f4d2a176389750d0135.exe
- Size 41KB
- Sample240704-dpysza1fmn
- SHA256 c0375f5535c86d8dd8b517da3b8802695905a8b3ea817f4d2a176389750d0135
Malware Config
Signatures
- Detected microsoft outlook phishing page
- Executes dropped EXE 1 IoCs
- UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops file in Windows directory 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0375f5535c86d8dd8b517da3b8802695905a8b3ea817f4d2a176389750d0135.exe"C:\Users\Admin\AppData\Local\Temp\c0375f5535c86d8dd8b517da3b8802695905a8b3ea817f4d2a176389750d0135.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
D1FEXLDW.htm
results[4].htm
results[5].htm
search[3].htm
search[2].htm
searchD8LK63ML.htm
search[2].htm
Qleick.log
tmpD82D.tmp
zincite.log
zincite.log
zincite.log
services.exe
memory/1148-309-0x0000000000500000-0x0000000000510200-memory.dmp
memory/1148-238-0x0000000000500000-0x0000000000510200-memory.dmp
memory/1148-49-0x0000000000500000-0x0000000000510200-memory.dmp
memory/1148-13-0x0000000000500000-0x0000000000510200-memory.dmp
memory/1148-47-0x0000000000500000-0x0000000000510200-memory.dmp
memory/1148-316-0x0000000000500000-0x0000000000510200-memory.dmp
memory/1148-0-0x0000000000500000-0x0000000000510200-memory.dmp
memory/2976-38-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2976-310-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2976-36-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2976-239-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2976-26-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2976-24-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2976-48-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2976-31-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2976-312-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2976-43-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2976-317-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2976-19-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2976-50-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2976-14-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2976-6-0x0000000000400000-0x0000000000408000-memory.dmp