3c5ad4612f2b8447dafa03e2d95b075d9da1b4af723ca6d19038987114ee70c4

General

Target

3c5ad4612f2b8447dafa03e2d95b075d9da1b4af723ca6d19038987114ee70c4.exe
Size

41KB
MD5

0bde2fbf11ae6b7e5229b69bfca1c6bd
SHA1

5ef2d78bb62b51a03c3beafe818ed77460efe45a
SHA256

3c5ad4612f2b8447dafa03e2d95b075d9da1b4af723ca6d19038987114ee70c4
SHA512

cf638c5c14c78a9a6b3fc2aeb8d9fddc1fedc795c3a5c482106c1972eceefe9ead9df10e5cb23d25b2261a1f46a8b382ec4365260471d18e306429ecef1df6d7
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/N:AEwVs+0jNDY1qi/qV

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4004	services.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/828-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x0008000000023459-4.dat	upx
behavioral2/memory/4004-7-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/828-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4004-14-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4004-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4004-24-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4004-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4004-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4004-36-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4004-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4004-43-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4004-48-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/828-49-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4004-50-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/828-54-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4004-55-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x000400000001e764-65.dat	upx
behavioral2/memory/828-151-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4004-152-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/828-177-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4004-178-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4004-182-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	3c5ad4612f2b8447dafa03e2d95b075d9da1b4af723ca6d19038987114ee70c4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	3c5ad4612f2b8447dafa03e2d95b075d9da1b4af723ca6d19038987114ee70c4.exe
File opened for modification	C:\Windows\java.exe	3c5ad4612f2b8447dafa03e2d95b075d9da1b4af723ca6d19038987114ee70c4.exe
File created	C:\Windows\java.exe	3c5ad4612f2b8447dafa03e2d95b075d9da1b4af723ca6d19038987114ee70c4.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c5ad4612f2b8447dafa03e2d95b075d9da1b4af723ca6d19038987114ee70c4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 4004	828	3c5ad4612f2b8447dafa03e2d95b075d9da1b4af723ca6d19038987114ee70c4.exe	83
PID 828 wrote to memory of 4004	828	3c5ad4612f2b8447dafa03e2d95b075d9da1b4af723ca6d19038987114ee70c4.exe	83
PID 828 wrote to memory of 4004	828	3c5ad4612f2b8447dafa03e2d95b075d9da1b4af723ca6d19038987114ee70c4.exe	83

C:\Users\Admin\AppData\Local\Temp\3c5ad4612f2b8447dafa03e2d95b075d9da1b4af723ca6d19038987114ee70c4.exe
"C:\Users\Admin\AppData\Local\Temp\3c5ad4612f2b8447dafa03e2d95b075d9da1b4af723ca6d19038987114ee70c4.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CFIOOOZS\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2CD5.tmp

Filesize
41KB

MD5
709992806cba5ffccaaea5639d8e6712

SHA1
52b0edb1b95d6c09541bd98fa1befd252b7eb558

SHA256
63c4b7f4398b8b2c3331cc4661b8a1cd122665e8267198465d89a19043c04576

SHA512
e722515ba848ad1e7b25b92761f65e2717820847d7b7cc2b8e36d8f7885ddeaf9f1fd6c5cff25b49113b59eb85d99dfbe349e06df691af4a5d60fa9d0c0ebe97

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
192B

MD5
3682d6ccf1f0014c9fecc30442a4a1ba

SHA1
9764917af7dbfa0a84a7022f03c1cea5ba867ca0

SHA256
457dc28e03b4e12448c67c005ff21606c56e250903da6ba05abce7030e8f8ea3

SHA512
8a20f5bb481fd738c2b9d1289dfb9072d7e11d21799323c60ba3f43be01d017d9337676f892db3ce0ee2799ba9f27875d3349c1fe3d0fb5083b12dc8a7ee009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
192B

MD5
9ba8f2b40eef8c6aeb483ea8b89653f5

SHA1
fb6eebdebece63255eb7b1ea8dd8e114ef9c9c98

SHA256
8fadf6d44d94bb7e13f9a548e9dfc53a92987ae15ac1bbcf6351c2e7497dbdc3

SHA512
915b403dca6e88a371d81c2d2c909fe4ac9eddbe7be1e529716d0e8b295af0ca2dd73a4f73193c1f91d6e61c3b8b68625d4586d626c1cf8531b651d473d04abf

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/828-49-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/828-177-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/828-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/828-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/828-151-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/828-54-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4004-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4004-31-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4004-43-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4004-50-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4004-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4004-55-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4004-36-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4004-48-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4004-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4004-24-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4004-152-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4004-14-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4004-7-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4004-178-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4004-182-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads