25ce0b595f354af00d83f5b9375b020109ca6ca525f2a1a2fe1ef3550b407116

General

Target

00287e81dce70fb72412bfb675cf47a0N.exe
Size

28KB
MD5

00287e81dce70fb72412bfb675cf47a0
SHA1

9b7aa522ba13c449d2d853348e4b57f831be2c49
SHA256

25ce0b595f354af00d83f5b9375b020109ca6ca525f2a1a2fe1ef3550b407116
SHA512

27e9a043965dcb8ead139e732e72244296ec6e30ad5d8fe41f605d7412f7f856dd3fc3e0c4c7a750ea444cbef7993235fb2d7dcb7a24a8581a969f5469f445a2
SSDEEP

384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNGtP/97:Dv8IRRdsxq1DjJcqf5H97

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2876	services.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3004-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/3004-4-0x0000000000220000-0x0000000000228000-memory.dmp	upx
behavioral1/files/0x0009000000016610-7.dat	upx
behavioral1/memory/2876-11-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/3004-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2876-18-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2876-23-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2876-29-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2876-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2876-36-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2876-41-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2876-43-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2876-48-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/3004-52-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2876-53-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2876-55-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x0004000000004ed7-63.dat	upx
behavioral1/memory/3004-73-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2876-74-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	00287e81dce70fb72412bfb675cf47a0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	00287e81dce70fb72412bfb675cf47a0N.exe
File opened for modification	C:\Windows\java.exe	00287e81dce70fb72412bfb675cf47a0N.exe
File created	C:\Windows\java.exe	00287e81dce70fb72412bfb675cf47a0N.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00287e81dce70fb72412bfb675cf47a0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2876	3004	00287e81dce70fb72412bfb675cf47a0N.exe	31
PID 3004 wrote to memory of 2876	3004	00287e81dce70fb72412bfb675cf47a0N.exe	31
PID 3004 wrote to memory of 2876	3004	00287e81dce70fb72412bfb675cf47a0N.exe	31
PID 3004 wrote to memory of 2876	3004	00287e81dce70fb72412bfb675cf47a0N.exe	31

C:\Users\Admin\AppData\Local\Temp\00287e81dce70fb72412bfb675cf47a0N.exe
"C:\Users\Admin\AppData\Local\Temp\00287e81dce70fb72412bfb675cf47a0N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp824A.tmp

Filesize
28KB

MD5
9a9934a6253c1b3127fb951249f1db08

SHA1
663f8ac376b7264bcb1ac5a46ada1984ec563a8d

SHA256
11cf698ccb1527249607750f8821ddc966d45544b32ab1cdb558a4fa4f8a39cd

SHA512
a9daca52918ea7fd50ce80cdab14f7606ff65d58be00f02b86f32975c577c010bd87200efc94a35e28dcd5dfc8939975ecca8bb2cebdcd514529e74f5d805288

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
235ff7c5ee028e5f3550136f48cc823f

SHA1
05faf120e9084a87effca0dac1b8d1eadf7fe02b

SHA256
1f4a1599f2b1fd930efc2f7a851792566096e75946ca06a61fd509784a50a884

SHA512
657a8c0baf3271eff88aba103cfb762596873a4de63a40f7acebd36ab212f10c8aee49645cf62b33f3b00a7a63cd1f1df2d64ced35b352718be1fc16abea9d07

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2876-29-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2876-53-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2876-74-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2876-18-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2876-23-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2876-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2876-55-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2876-31-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2876-36-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2876-41-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2876-43-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2876-48-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3004-52-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3004-10-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/3004-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3004-24-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/3004-4-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/3004-73-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3004-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads