ae2ecb01a760ef72ea9385eb2f123425552accde46e09cb64295521ac560e4e5

General

Target

ae2ecb01a760ef72ea9385eb2f123425552accde46e09cb64295521ac560e4e5.exe
Size

41KB
MD5

32aad1fe1e9ba9d126cac4098a26a4f0
SHA1

f03864772377f3c0f12c8b996386520368f49cb5
SHA256

ae2ecb01a760ef72ea9385eb2f123425552accde46e09cb64295521ac560e4e5
SHA512

59ec3a094e3cdadb01f1e992881df17d75c6e2e1f65d0cb4d845c6262259f88ee02be1526ec5809c30b66de6cd3b4d3cd84210c80f46b2d90899e61b7ec93758
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3576	services.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1004-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x0008000000023532-4.dat	upx
behavioral2/memory/3576-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1004-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3576-14-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3576-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3576-20-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3576-25-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3576-27-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3576-32-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3576-37-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3576-39-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3576-44-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1004-45-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3576-49-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1004-50-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x000400000001e76c-60.dat	upx
behavioral2/memory/3576-115-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1004-139-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3576-140-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1004-141-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3576-145-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3576-147-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1004-151-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/3576-152-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1004-175-0x0000000000500000-0x0000000000510200-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	ae2ecb01a760ef72ea9385eb2f123425552accde46e09cb64295521ac560e4e5.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	ae2ecb01a760ef72ea9385eb2f123425552accde46e09cb64295521ac560e4e5.exe
File opened for modification	C:\Windows\java.exe	ae2ecb01a760ef72ea9385eb2f123425552accde46e09cb64295521ac560e4e5.exe
File created	C:\Windows\java.exe	ae2ecb01a760ef72ea9385eb2f123425552accde46e09cb64295521ac560e4e5.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 3576	1004	ae2ecb01a760ef72ea9385eb2f123425552accde46e09cb64295521ac560e4e5.exe	85
PID 1004 wrote to memory of 3576	1004	ae2ecb01a760ef72ea9385eb2f123425552accde46e09cb64295521ac560e4e5.exe	85
PID 1004 wrote to memory of 3576	1004	ae2ecb01a760ef72ea9385eb2f123425552accde46e09cb64295521ac560e4e5.exe	85

C:\Users\Admin\AppData\Local\Temp\ae2ecb01a760ef72ea9385eb2f123425552accde46e09cb64295521ac560e4e5.exe
"C:\Users\Admin\AppData\Local\Temp\ae2ecb01a760ef72ea9385eb2f123425552accde46e09cb64295521ac560e4e5.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:3576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp1E0F.tmp

Filesize
41KB

MD5
349b57f8ff7d2af0347bbf7ea7f01ff6

SHA1
8d8a770d582bacb6eef215d513b257045968e3b3

SHA256
57382a1465f3bdfca48c1f39f3ca0d02f1e265b981fd84c2754bc62871a1ed13

SHA512
befdf588229b661e33c463a67cf089f27a5cfd71ce313117f43b8d7f5315dbe1a50d35355be3440616103faff421a87b8f2f33bed5b976848cacef0a6d615eba

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
192B

MD5
222ac05d8f229f7e25177aa6760d4cfa

SHA1
b583d454e47c96dda3eef45f16b4cbdd15122725

SHA256
a2ed618a3b6a6d000194c13b24effafcb922794e7b3a2df3bb37084106952199

SHA512
3f6c729ca4fa6a665a3d6997e33353902909dc068a635495900580c8d52d7b9888558c04ba3b7fb353e796f4824fafb465acc4407b92726c065815360a319516

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
192B

MD5
d174eaa45dacb3ca7111078e83a90814

SHA1
f66ff61e4dfe33a015676133854b54e50884e9e9

SHA256
6410443d7914184ceaf90fa6eea44bd0b1b5ebe36f38cd38944d2a3505ee0a8f

SHA512
07b38322f166a0199ae587616ba094dadad14e91c83596f9cfffbd58d200d7e68de5bf8e5d617eff133a36cafc4b759a57ccf1973d679bddde03cd463fe15691

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1004-151-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1004-45-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1004-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1004-141-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1004-139-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1004-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1004-175-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1004-50-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3576-20-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3576-27-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3576-49-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3576-39-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3576-37-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3576-32-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3576-115-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3576-44-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3576-140-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3576-25-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3576-145-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3576-147-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3576-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3576-152-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3576-14-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3576-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads