Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
18/05/2025, 09:56
Static task
static1
Behavioral task
behavioral1
Sample
9bec196e2b6574b6b861b80d2c88f9df882665b4111f180c0e036f91e51ae4ce.exe
Resource
win10v2004-20250502-en
General
-
Target
9bec196e2b6574b6b861b80d2c88f9df882665b4111f180c0e036f91e51ae4ce.exe
-
Size
151KB
-
MD5
7b78be4d71426cef503871fded2dc0d2
-
SHA1
0352bcd5991a5bc6bc1184f938d2b736d813fbdb
-
SHA256
9bec196e2b6574b6b861b80d2c88f9df882665b4111f180c0e036f91e51ae4ce
-
SHA512
2e8ace21e00c7d9641275030d2d81f73abccf93158a09d0fbbbc128872948ce5bafaa23c1cf307d268ff0755746d2e06789dfcccc814a63de5311d1c40770aa3
-
SSDEEP
3072:yWTSIoXkZA/gwjHnrhtVufJO05m4uvHwog8yT5Fou:yWTSIoXNHnr1GJOl4uvjgddFF
Malware Config
Signatures
-
Renames multiple (5218) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
pid Process 4296 Zombie.exe 2196 _dotnet.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Zombie.exe 9bec196e2b6574b6b861b80d2c88f9df882665b4111f180c0e036f91e51ae4ce.exe File created C:\Windows\SysWOW64\Zombie.exe 9bec196e2b6574b6b861b80d2c88f9df882665b4111f180c0e036f91e51ae4ce.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-conio-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Office 2007 - 2010.eftx.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.deps.json.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\id.pak.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\include\jawt.h.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\sq.txt.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.PowerBI.AdomdClient.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\manifest.xml.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsFormsIntegration.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\hijrah-config-umalqura.properties.tmp Zombie.exe File created C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\eula.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\flavormap.properties.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8.mp4.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\rsod\osmuxmui.msi.16.en-us.boot.tree.dat.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\Microsoft.VisualBasic.Forms.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsFormsIntegration.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Top Shadow.eftx.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\jp2ssv.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwclassic.dotx.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Classic.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClientSideProviders.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\tzmappings.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\AdjacencyReport.dotx.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\ja.txt.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WORD_WHATSNEW.XML.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClientSideProviders.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClientSideProviders.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\UIAutomationClient.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Drawing.Design.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_WHATSNEW.XML.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClient.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processenvironment-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Dataflow.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFSYMK.TTF.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsFormsIntegration.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ppd.xrm-ms.tmp Zombie.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zombie.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bec196e2b6574b6b861b80d2c88f9df882665b4111f180c0e036f91e51ae4ce.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 5292 wrote to memory of 4296 5292 9bec196e2b6574b6b861b80d2c88f9df882665b4111f180c0e036f91e51ae4ce.exe 86 PID 5292 wrote to memory of 4296 5292 9bec196e2b6574b6b861b80d2c88f9df882665b4111f180c0e036f91e51ae4ce.exe 86 PID 5292 wrote to memory of 4296 5292 9bec196e2b6574b6b861b80d2c88f9df882665b4111f180c0e036f91e51ae4ce.exe 86 PID 5292 wrote to memory of 2196 5292 9bec196e2b6574b6b861b80d2c88f9df882665b4111f180c0e036f91e51ae4ce.exe 87 PID 5292 wrote to memory of 2196 5292 9bec196e2b6574b6b861b80d2c88f9df882665b4111f180c0e036f91e51ae4ce.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\9bec196e2b6574b6b861b80d2c88f9df882665b4111f180c0e036f91e51ae4ce.exe"C:\Users\Admin\AppData\Local\Temp\9bec196e2b6574b6b861b80d2c88f9df882665b4111f180c0e036f91e51ae4ce.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4296
-
-
C:\Users\Admin\AppData\Local\Temp\_dotnet.exe"_dotnet.exe"2⤵
- Executes dropped EXE
PID:2196
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18KB
MD5415c1a63ba478df225a4e08f426232f6
SHA1b572cb1ec3b74126e30a5a55afc26cf8e7db8e8b
SHA256ee11e73e5a92b70b1ee4a9c6626b06030326ba05272218ac20b2b9590eca3adb
SHA512e996d5f4ec9e36afcdd5b87c42ad8c4fe9882228a9c1f38ccd2a9762b773ef01a798ad2e9c404ca9bf6d1425b08124b0d00c7edd59ab679e878b31bfabbf7690
-
Filesize
133KB
MD5bd2e0226c5d444555a233930906e5779
SHA1ed7b36f8a6802008bba17b70c7c6beb873ca68b6
SHA256a8cd8b9bd4e4b99c7d6e509d1b4fefae7bc15c1e42a218e09ddfd4a924b3da9f
SHA512d2cdb8f7a384bdb8cfb82e67da27d05ba30206542bf54d815b71b8ba1ef43ebd8cdef3ed7a2debeccd397aeeb7196b29af966d7ea9cbb41acadaafb854e00971
-
Filesize
17KB
MD581fc313583ccf1af2e200d929f8296ac
SHA1367ebe8c9279cfe7ff9bcfcfb79abe2a84ab5aac
SHA2562db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7
SHA512628bb9220a1aececfeae1173e0efdf9e6eb21e5304f0a40492c3339c11b70c403376a368189ccf4a71ed0d3600c7ccc196531b2c2bb3cf92bd33187b35d1534c