Analysis Overview
SHA256
9bec196e2b6574b6b861b80d2c88f9df882665b4111f180c0e036f91e51ae4ce
Threat Level: Likely malicious
The file 9bec196e2b6574b6b861b80d2c88f9df882665b4111f180c0e036f91e51ae4ce was found to be: Likely malicious.
Malicious Activity Summary
Renames multiple (5218) files with added filename extension
Executes dropped EXE
Drops file in System32 directory
Drops file in Program Files directory
System Location Discovery: System Language Discovery
Unsigned PE
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V16
Analysis: static1
Detonation Overview
Reported
2025-05-18 09:56
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2025-05-18 09:56
Reported
2025-05-18 09:59
Platform
win10v2004-20250502-en
Max time kernel
150s
Max time network
136s
Command Line
Signatures
Renames multiple (5218) files with added filename extension
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\Zombie.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\_dotnet.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SysWOW64\Zombie.exe | C:\Users\Admin\AppData\Local\Temp\9bec196e2b6574b6b861b80d2c88f9df882665b4111f180c0e036f91e51ae4ce.exe | N/A |
| File created | C:\Windows\SysWOW64\Zombie.exe | C:\Users\Admin\AppData\Local\Temp\9bec196e2b6574b6b861b80d2c88f9df882665b4111f180c0e036f91e51ae4ce.exe | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-conio-l1-1-0.dll.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Office 2007 - 2010.eftx.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.deps.json.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\id.pak.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Java\jdk-1.8\include\jawt.h.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-pl.xrm-ms.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\7-Zip\Lang\sq.txt.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ppd.xrm-ms.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ul-oob.xrm-ms.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.PowerBI.AdomdClient.dll.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\manifest.xml.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsFormsIntegration.resources.dll.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Java\jre-1.8\lib\hijrah-config-umalqura.properties.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Java\jre-1.8\bin\eula.dll.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Java\jre-1.8\lib\flavormap.properties.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8.mp4.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\rsod\osmuxmui.msi.16.en-us.boot.tree.dat.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\Microsoft.VisualBasic.Forms.resources.dll.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsFormsIntegration.dll.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Top Shadow.eftx.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ul-oob.xrm-ms.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-phn.xrm-ms.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Java\jre-1.8\bin\jp2ssv.dll.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-pl.xrm-ms.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwclassic.dotx.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Classic.dll.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClientSideProviders.resources.dll.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Java\jre-1.8\lib\tzmappings.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Integration\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ppd.xrm-ms.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Templates\1033\AdjacencyReport.dotx.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\7-Zip\Lang\ja.txt.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\1033\WORD_WHATSNEW.XML.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClientSideProviders.resources.dll.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClientSideProviders.resources.dll.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\UIAutomationClient.resources.dll.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Drawing.Design.dll.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ppd.xrm-ms.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_WHATSNEW.XML.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClient.dll.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul-oob.xrm-ms.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processenvironment-l1-1-0.dll.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Dataflow.dll.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-oob.xrm-ms.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Office16\OFFSYMK.TTF.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.dll.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsFormsIntegration.resources.dll.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140.dll.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ppd.xrm-ms.tmp | C:\Windows\SysWOW64\Zombie.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\Zombie.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\9bec196e2b6574b6b861b80d2c88f9df882665b4111f180c0e036f91e51ae4ce.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 5292 wrote to memory of 4296 | N/A | C:\Users\Admin\AppData\Local\Temp\9bec196e2b6574b6b861b80d2c88f9df882665b4111f180c0e036f91e51ae4ce.exe | C:\Windows\SysWOW64\Zombie.exe |
| PID 5292 wrote to memory of 4296 | N/A | C:\Users\Admin\AppData\Local\Temp\9bec196e2b6574b6b861b80d2c88f9df882665b4111f180c0e036f91e51ae4ce.exe | C:\Windows\SysWOW64\Zombie.exe |
| PID 5292 wrote to memory of 4296 | N/A | C:\Users\Admin\AppData\Local\Temp\9bec196e2b6574b6b861b80d2c88f9df882665b4111f180c0e036f91e51ae4ce.exe | C:\Windows\SysWOW64\Zombie.exe |
| PID 5292 wrote to memory of 2196 | N/A | C:\Users\Admin\AppData\Local\Temp\9bec196e2b6574b6b861b80d2c88f9df882665b4111f180c0e036f91e51ae4ce.exe | C:\Users\Admin\AppData\Local\Temp\_dotnet.exe |
| PID 5292 wrote to memory of 2196 | N/A | C:\Users\Admin\AppData\Local\Temp\9bec196e2b6574b6b861b80d2c88f9df882665b4111f180c0e036f91e51ae4ce.exe | C:\Users\Admin\AppData\Local\Temp\_dotnet.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\9bec196e2b6574b6b861b80d2c88f9df882665b4111f180c0e036f91e51ae4ce.exe
"C:\Users\Admin\AppData\Local\Temp\9bec196e2b6574b6b861b80d2c88f9df882665b4111f180c0e036f91e51ae4ce.exe"
C:\Windows\SysWOW64\Zombie.exe
"C:\Windows\system32\Zombie.exe"
C:\Users\Admin\AppData\Local\Temp\_dotnet.exe
"_dotnet.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 150.171.27.10:443 | g.bing.com | tcp |
| GB | 2.18.27.76:443 | www.bing.com | tcp |
| GB | 2.18.27.76:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| GB | 142.250.178.3:80 | c.pki.goog | tcp |
Files
C:\Windows\SysWOW64\Zombie.exe
| MD5 | 81fc313583ccf1af2e200d929f8296ac |
| SHA1 | 367ebe8c9279cfe7ff9bcfcfb79abe2a84ab5aac |
| SHA256 | 2db302b332c82e45bb493ba1eb081041da9ec60c861ec82c65d6f5177d13b9d7 |
| SHA512 | 628bb9220a1aececfeae1173e0efdf9e6eb21e5304f0a40492c3339c11b70c403376a368189ccf4a71ed0d3600c7ccc196531b2c2bb3cf92bd33187b35d1534c |
C:\Users\Admin\AppData\Local\Temp\_dotnet.exe
| MD5 | bd2e0226c5d444555a233930906e5779 |
| SHA1 | ed7b36f8a6802008bba17b70c7c6beb873ca68b6 |
| SHA256 | a8cd8b9bd4e4b99c7d6e509d1b4fefae7bc15c1e42a218e09ddfd4a924b3da9f |
| SHA512 | d2cdb8f7a384bdb8cfb82e67da27d05ba30206542bf54d815b71b8ba1ef43ebd8cdef3ed7a2debeccd397aeeb7196b29af966d7ea9cbb41acadaafb854e00971 |
C:\$Recycle.Bin\S-1-5-21-2930597513-779029253-718817275-1000\desktop.ini.tmp
| MD5 | 415c1a63ba478df225a4e08f426232f6 |
| SHA1 | b572cb1ec3b74126e30a5a55afc26cf8e7db8e8b |
| SHA256 | ee11e73e5a92b70b1ee4a9c6626b06030326ba05272218ac20b2b9590eca3adb |
| SHA512 | e996d5f4ec9e36afcdd5b87c42ad8c4fe9882228a9c1f38ccd2a9762b773ef01a798ad2e9c404ca9bf6d1425b08124b0d00c7edd59ab679e878b31bfabbf7690 |
memory/5292-23-0x0000000000400000-0x0000000000407000-memory.dmp