2242ec357cdf0632dee35d79bd8b912d68fefb04613fce60a61bcac29bc377b1

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 20:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe
Size

78KB
MD5

bf2c1ce908f4a8e1ba62fc5317b70b10
SHA1

2a193ea78184a4b29e150ecbc661db2239b8de4f
SHA256

2242ec357cdf0632dee35d79bd8b912d68fefb04613fce60a61bcac29bc377b1
SHA512

91c85e8c726ef2e7213d9daf322651a977e7f1f9166a46871437de861ee74e1f82ddd5c3d4dc51bea8057918b3d44e5b32f2fe60f3a4d4cfded19b9f3759f0ea
SSDEEP

1536:5lrsicagdzn8K2ariPOcjk+XQuPVN72NMShZEdKKQL:5JjcF8KfCOcjk+guPVjShdKi

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2836-0-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral2/files/0x00070000000231c8-6.dat	upx
behavioral2/memory/2836-34-0x0000000000400000-0x0000000000467000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\macromd\little chicken shy about exposing sweet cunt.mpg.pif	NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe
File created	C:\Windows\SysWOW64\macromd\cute blonde cheerleader dancing.mpg.pif	NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe
File created	C:\Windows\SysWOW64\macromd\two teenie boppers learning to eat pussy.mpg.pif	NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe
File created	C:\Windows\SysWOW64\macromd\maid's vagina plowed by big cock.mpg.pif	NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe
File created	C:\Windows\SysWOW64\macromd\slutty cum babes sharing a dick.mpg.pif	NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe
File created	C:\Windows\SysWOW64\macromd\Britney spears nude.exe	NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe
File created	C:\Windows\SysWOW64\macromd\ICQ Hackingtools.exe	NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe
File created	C:\Windows\SysWOW64\macromd\tenderonie who insist her pussy must always be free.mpg.pif	NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe
File created	C:\Windows\SysWOW64\macromd\cute teen fingering herself on the sofa.mpg.pif	NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe
File created	C:\Windows\SysWOW64\macromd\blonde on couch gettin tight anal fucking.mpg.pif	NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe
File created	C:\Windows\SysWOW64\macromd\violent preteen gang bang illegal.mpg.exe	NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe
File created	C:\Windows\SysWOW64\macromd\yahoo hacker.exe	NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe
File created	C:\Windows\SysWOW64\macromd\hot tomoli lathering up sexy body for boyfriend's tongue.mpg.pif	NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe
File created	C:\Windows\SysWOW64\macromd\amateur swinger babe sucking on a couple of cocks.mpg.pif	NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe
File created	C:\Windows\SysWOW64\macromd\chunky broad with a hairy well used ass.mpg.pif	NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe
File created	C:\Windows\SysWOW64\macromd\shanks who serve up smelly pootang.mpg.pif	NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe
File created	C:\Windows\SysWOW64\macromd\Counter Strike CD Keygen.exe	NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe
File created	C:\Windows\SysWOW64\macromd\illegal preteen porn anal fisting.mpg.pif	NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe
File created	C:\Windows\SysWOW64\macromd\japanes girl getting it from behind.mpg.pif	NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe
File created	C:\Windows\SysWOW64\macromd\chicks working orgasm from dude's cock as a present.mpg.pif	NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe
File created	C:\Windows\SysWOW64\macromd\busty older bitch gets slammed.mpg.pif	NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe
File created	C:\Windows\SysWOW64\macromd\16 year old webcam.mpg.exe	NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe
File created	C:\Windows\SysWOW64\macromd\horny housewife looking for some action.mpg.pif	NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe
File created	C:\Windows\SysWOW64\macromd\babe locking lips around her man's rod in backyard.mpg.pif	NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe
File created	C:\Windows\SysWOW64\macromd\kinky banana in pussy.mpg.pif	NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe
File created	C:\Windows\SysWOW64\macromd\petite ebony enjoying her joy toy.mpg.pif	NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe
File created	C:\Windows\SysWOW64\winxcfg.exe	NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe
File created	C:\Windows\SysWOW64\macromd\Hotmail Hacker.exe	NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe
File created	C:\Windows\SysWOW64\macromd\asian slut with puffy exotic lips.mpg.pif	NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe
File created	C:\Windows\SysWOW64\macromd\AIM Account Stealer.exe	NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe
File created	C:\Windows\SysWOW64\macromd\sexy blonde teasing pussy.mpg.pif	NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe
File created	C:\Windows\SysWOW64\macromd\icqcracker.exe	NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe
File created	C:\Windows\SysWOW64\macromd\sunbathing beauties tanning tender pussy lips.mpg.pif	NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.bf2c1ce908f4a8e1ba62fc5317b70b10.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\macromd\ICQ Hackingtools.exe

Filesize
93KB

MD5
7160baad10335692cfaa668765dbc398

SHA1
362bc6ad2e87e280605e9c9319eb6e6d7cf1368e

SHA256
3d7f02830a321c8ae4e452c7bd04674e611a0bed42bbfb9a497d43cc6d501cdc

SHA512
778f6ffc5530b70fab8e35a95b44a18fb79f5706326dfa2d14115f1e20ab2ad8ea7a43aae27985c0a6b721674980f28a79a2100018f1d610ef2e9d112e62b4cf

Download Submit
memory/2836-0-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2836-34-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads