b56528c6b71632379bbb9184ce0ef02d1a111c915ca748b54228ff42c9b51d7b

General

Target

b56528c6b71632379bbb9184ce0ef02d1a111c915ca748b54228ff42c9b51d7b.exe
Size

79KB
MD5

56d6f898fdf86a556108b8bfea99b990
SHA1

83e9872aefbc97d0dc7e9fc1ab968403b49427b5
SHA256

b56528c6b71632379bbb9184ce0ef02d1a111c915ca748b54228ff42c9b51d7b
SHA512

0400ed0e02a3bff9a1daf26d0b242a3db0c158df9f9b992c1d665942aed7689de6e013bac7d8c562b4a3d6de686d3a5dc62443f709a1f9d808a480ed8f96c659
SSDEEP

1536:5lrsicagdzn8K2ariPOcjk+XQuPVN72NMSAGQvXTlHeU:5JjcF8KfCOcjk+guPVjSbQvXZ+U

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/852-54-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral1/memory/852-55-0x0000000000400000-0x0000000000467000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

b56528c6b71632379bbb9184ce0ef02d1a111c915ca748b54228ff42c9b51d7b.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	b56528c6b71632379bbb9184ce0ef02d1a111c915ca748b54228ff42c9b51d7b.exe

Drops file in System32 directory 27 IoCs

Processes:

b56528c6b71632379bbb9184ce0ef02d1a111c915ca748b54228ff42c9b51d7b.exe

description	ioc	process
File created	C:\Windows\SysWOW64\macromd\amateur slut with a huge gun.mpg.pif	b56528c6b71632379bbb9184ce0ef02d1a111c915ca748b54228ff42c9b51d7b.exe
File created	C:\Windows\SysWOW64\macromd\trailor tramp pissing for you.mpg.pif	b56528c6b71632379bbb9184ce0ef02d1a111c915ca748b54228ff42c9b51d7b.exe
File created	C:\Windows\SysWOW64\macromd\illgal incest preteen porn cum.mpg.exe	b56528c6b71632379bbb9184ce0ef02d1a111c915ca748b54228ff42c9b51d7b.exe
File created	C:\Windows\SysWOW64\macromd\preteen sucking huge cock illegal.mpg.exe	b56528c6b71632379bbb9184ce0ef02d1a111c915ca748b54228ff42c9b51d7b.exe
File created	C:\Windows\SysWOW64\macromd\yummy lesbos licking.mpg.pif	b56528c6b71632379bbb9184ce0ef02d1a111c915ca748b54228ff42c9b51d7b.exe
File created	C:\Windows\SysWOW64\macromd\cutie spreading her pussy lips.mpg.pif	b56528c6b71632379bbb9184ce0ef02d1a111c915ca748b54228ff42c9b51d7b.exe
File created	C:\Windows\SysWOW64\macromd\brunette fucking in bedroom with boyfriend.mpg.pif	b56528c6b71632379bbb9184ce0ef02d1a111c915ca748b54228ff42c9b51d7b.exe
File created	C:\Windows\SysWOW64\macromd\kinky banana in pussy.mpg.pif	b56528c6b71632379bbb9184ce0ef02d1a111c915ca748b54228ff42c9b51d7b.exe
File created	C:\Windows\SysWOW64\macromd\sexy teen lesbians licking pussy.mpg.pif	b56528c6b71632379bbb9184ce0ef02d1a111c915ca748b54228ff42c9b51d7b.exe
File created	C:\Windows\SysWOW64\macromd\brownhair toon with glasses nude.mpg.pif	b56528c6b71632379bbb9184ce0ef02d1a111c915ca748b54228ff42c9b51d7b.exe
File created	C:\Windows\SysWOW64\macromd\head rooster pimping hot little tender ass chickens.mpg.pif	b56528c6b71632379bbb9184ce0ef02d1a111c915ca748b54228ff42c9b51d7b.exe
File created	C:\Windows\SysWOW64\macromd\yummy lesbos licking wet pussy holes.mpg.pif	b56528c6b71632379bbb9184ce0ef02d1a111c915ca748b54228ff42c9b51d7b.exe
File created	C:\Windows\SysWOW64\macromd\stud fucking his blonde french maid.mpg.pif	b56528c6b71632379bbb9184ce0ef02d1a111c915ca748b54228ff42c9b51d7b.exe
File created	C:\Windows\SysWOW64\macromd\strange asian ass odyssey.mpg.pif	b56528c6b71632379bbb9184ce0ef02d1a111c915ca748b54228ff42c9b51d7b.exe
File created	C:\Windows\SysWOW64\macromd\sylvia lauren showing her assets.mpg.pif	b56528c6b71632379bbb9184ce0ef02d1a111c915ca748b54228ff42c9b51d7b.exe
File created	C:\Windows\SysWOW64\macromd\cutie nailed up the ass.mpg.pif	b56528c6b71632379bbb9184ce0ef02d1a111c915ca748b54228ff42c9b51d7b.exe
File created	C:\Windows\SysWOW64\macromd\her taking a dildo right in the ass.mpg.pif	b56528c6b71632379bbb9184ce0ef02d1a111c915ca748b54228ff42c9b51d7b.exe
File created	C:\Windows\SysWOW64\macromd\this really wild insane groupsex.mpg.pif	b56528c6b71632379bbb9184ce0ef02d1a111c915ca748b54228ff42c9b51d7b.exe
File created	C:\Windows\SysWOW64\macromd\MSN Password Hacker and Stealer.exe	b56528c6b71632379bbb9184ce0ef02d1a111c915ca748b54228ff42c9b51d7b.exe
File created	C:\Windows\SysWOW64\macromd\blonde showing her pussy to her neighbor.mpg.pif	b56528c6b71632379bbb9184ce0ef02d1a111c915ca748b54228ff42c9b51d7b.exe
File created	C:\Windows\SysWOW64\macromd\hot actress heather graham naked.mpg.pif	b56528c6b71632379bbb9184ce0ef02d1a111c915ca748b54228ff42c9b51d7b.exe
File created	C:\Windows\SysWOW64\macromd\lesbian strapon dildo entertainments.mpg.pif	b56528c6b71632379bbb9184ce0ef02d1a111c915ca748b54228ff42c9b51d7b.exe
File created	C:\Windows\SysWOW64\macromd\Bondage Fetish Foot Cum.exe	b56528c6b71632379bbb9184ce0ef02d1a111c915ca748b54228ff42c9b51d7b.exe
File created	C:\Windows\SysWOW64\macromd\horny ass licking lesbians.mpg.pif	b56528c6b71632379bbb9184ce0ef02d1a111c915ca748b54228ff42c9b51d7b.exe
File created	C:\Windows\SysWOW64\winxcfg.exe	b56528c6b71632379bbb9184ce0ef02d1a111c915ca748b54228ff42c9b51d7b.exe
File created	C:\Windows\SysWOW64\macromd\happy babe who got 12 inches last night.mpg.pif	b56528c6b71632379bbb9184ce0ef02d1a111c915ca748b54228ff42c9b51d7b.exe
File created	C:\Windows\SysWOW64\macromd\large lesbo sluts in bondage.mpg.pif	b56528c6b71632379bbb9184ce0ef02d1a111c915ca748b54228ff42c9b51d7b.exe

C:\Users\Admin\AppData\Local\Temp\b56528c6b71632379bbb9184ce0ef02d1a111c915ca748b54228ff42c9b51d7b.exe
"C:\Users\Admin\AppData\Local\Temp\b56528c6b71632379bbb9184ce0ef02d1a111c915ca748b54228ff42c9b51d7b.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/852-54-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/852-55-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads