Overview
overview
10Static
static
8trojan/1.exe
windows7_x64
10trojan/1.exe
windows10-2004_x64
10trojan/10.exe
windows7_x64
10trojan/10.exe
windows10-2004_x64
8trojan/2.exe
windows7_x64
3trojan/2.exe
windows10-2004_x64
5trojan/3.exe
windows7_x64
10trojan/3.exe
windows10-2004_x64
10trojan/4.exe
windows7_x64
8trojan/4.exe
windows10-2004_x64
8trojan/5.exe
windows7_x64
8trojan/5.exe
windows10-2004_x64
8trojan/6.exe
windows7_x64
10trojan/6.exe
windows10-2004_x64
10trojan/7.exe
windows7_x64
10trojan/7.exe
windows10-2004_x64
10trojan/8.exe
windows7_x64
trojan/8.exe
windows10-2004_x64
10trojan/9.exe
windows7_x64
8trojan/9.exe
windows10-2004_x64
8Analysis
-
max time kernel
30s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
07-07-2022 09:24
Static task
static1
Behavioral task
behavioral1
Sample
trojan/1.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
trojan/1.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
trojan/10.exe
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
trojan/10.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
trojan/2.exe
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
trojan/2.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral7
Sample
trojan/3.exe
Resource
win7-20220414-en
Behavioral task
behavioral8
Sample
trojan/3.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral9
Sample
trojan/4.exe
Resource
win7-20220414-en
Behavioral task
behavioral10
Sample
trojan/4.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral11
Sample
trojan/5.exe
Resource
win7-20220414-en
Behavioral task
behavioral12
Sample
trojan/5.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral13
Sample
trojan/6.exe
Resource
win7-20220414-en
Behavioral task
behavioral14
Sample
trojan/6.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral15
Sample
trojan/7.exe
Resource
win7-20220414-en
Behavioral task
behavioral16
Sample
trojan/7.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral17
Sample
trojan/8.exe
Resource
win7-20220414-en
Behavioral task
behavioral18
Sample
trojan/8.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral19
Sample
trojan/9.exe
Resource
win7-20220414-en
Behavioral task
behavioral20
Sample
trojan/9.exe
Resource
win10v2004-20220414-en
General
-
Target
trojan/4.exe
-
Size
89KB
-
MD5
ff0378ea8f209c085c4ff00b67ef23fa
-
SHA1
187fc7cc78740db57c1dc0bd9a2fa017c9160f1f
-
SHA256
885b63ca1d23550c56d34a5a5195bba4cc21c59f7161d38781eb2cd85aee0bbb
-
SHA512
f819e0f1b01232de9ba773a308aba2791ad75033122b1866bff94357c05f55bacaae17c15f607218ffeba8ab77c23faef92061d076fe6cfbf4def251bfd2d184
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral9/memory/552-54-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral9/memory/552-55-0x0000000000400000-0x0000000000464000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
4.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe" 4.exe -
Drops file in System32 directory 27 IoCs
Processes:
4.exedescription ioc process File created C:\Windows\SysWOW64\macromd\fetish bondage preteen porno.mpg.pif 4.exe File created C:\Windows\SysWOW64\macromd\chubby girl fucked from all angles xxx.exe 4.exe File created C:\Windows\SysWOW64\macromd\Britney Spears Dance Beat.exe 4.exe File created C:\Windows\SysWOW64\macromd\AIM Password Stealer.exe 4.exe File created C:\Windows\SysWOW64\macromd\AOL.exe 4.exe File created C:\Windows\SysWOW64\macromd\14 year old on beach.mpg.exe 4.exe File created C:\Windows\SysWOW64\macromd\Lolita preteen sex.mpeg.pif 4.exe File created C:\Windows\SysWOW64\macromd\Another bang bus victim forced rape sex cum.mpg.exe 4.exe File created C:\Windows\SysWOW64\macromd\Flash Golf.exe 4.exe File created C:\Windows\SysWOW64\macromd\12 year old forced rape cum.exe 4.exe File created C:\Windows\SysWOW64\macromd\Windows 2000.exe 4.exe File created C:\Windows\SysWOW64\macromd\Britney spears nude.exe 4.exe File created C:\Windows\SysWOW64\macromd\preteen sucking huge cock illegal.mpg.exe 4.exe File created C:\Windows\SysWOW64\macromd\Free Porn.exe 4.exe File created C:\Windows\SysWOW64\macromd\AOL, MSN, Yahoo mail password stealer.exe 4.exe File created C:\Windows\SysWOW64\macromd\cute girl giving head.exe 4.exe File created C:\Windows\SysWOW64\macromd\teen tied up and raped.exe 4.exe File created C:\Windows\SysWOW64\macromd\Bondage Fetish Foot Cum.exe 4.exe File created C:\Windows\SysWOW64\macromd\Want to see a massive horse cock in a tight little teen's pussy.mpg.pif 4.exe File created C:\Windows\SysWOW64\macromd\OfficeXP Keygen.exe 4.exe File created C:\Windows\SysWOW64\winxcfg.exe 4.exe File created C:\Windows\SysWOW64\macromd\invisible IP.exe 4.exe File created C:\Windows\SysWOW64\macromd\Xbox Iso 2 Rom Converter.exe 4.exe File created C:\Windows\SysWOW64\macromd\GTA 3 Crack.exe 4.exe File created C:\Windows\SysWOW64\macromd\Yahoo mail cracker.exe 4.exe File created C:\Windows\SysWOW64\macromd\Jenna Jameson Nude Gang Bang Forced Cum Blowjob.mpg.pif 4.exe File created C:\Windows\SysWOW64\macromd\CKY3 - Bam Margera World Industries Alien Workshop.exe 4.exe