42b943eba16681086254d500a11e81f0960dbb0b8f7c1c374faea8eec7ec60c3

General

Target

NEAS.d1d8bc6075d03a07ed28a53487a92780.exe
Size

61KB
MD5

d1d8bc6075d03a07ed28a53487a92780
SHA1

41f24bac1cacaa4d3e8147e33475c88be1cc63c7
SHA256

42b943eba16681086254d500a11e81f0960dbb0b8f7c1c374faea8eec7ec60c3
SHA512

87cf9e06c7116f93397ac90eeae31bd691ddc19629d0b0ecde01a619f43cb29e4311a0f0944447ea5db3f9f68e07649507bb16736a91abfb7d2dad236430383c
SSDEEP

1536:y4QQ6NSyM61l19piO+LV8YEoI/EU9RUe4mfS0psP:y4X6NSyfnpijeYEoIcq4YSCsP

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2320-0-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/files/0x0007000000015619-6.dat	upx
behavioral1/memory/2320-28-0x0000000000400000-0x0000000000464000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	NEAS.d1d8bc6075d03a07ed28a53487a92780.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\macromd\Britney Spears Dance Beat.exe	NEAS.d1d8bc6075d03a07ed28a53487a92780.exe
File created	C:\Windows\SysWOW64\macromd\Counter Strike CD Keygen.exe	NEAS.d1d8bc6075d03a07ed28a53487a92780.exe
File created	C:\Windows\SysWOW64\macromd\jenna jameson - shower scene.exe	NEAS.d1d8bc6075d03a07ed28a53487a92780.exe
File created	C:\Windows\SysWOW64\macromd\nude.exe	NEAS.d1d8bc6075d03a07ed28a53487a92780.exe
File created	C:\Windows\SysWOW64\macromd\Choke on cum (sodomy, rape).mpg.exe	NEAS.d1d8bc6075d03a07ed28a53487a92780.exe
File created	C:\Windows\SysWOW64\macromd\jenna jameson - xxx nurse scene.mpg.pif	NEAS.d1d8bc6075d03a07ed28a53487a92780.exe
File created	C:\Windows\SysWOW64\macromd\ICQ Hackingtools.exe	NEAS.d1d8bc6075d03a07ed28a53487a92780.exe
File created	C:\Windows\SysWOW64\macromd\AIM Password Stealer.exe	NEAS.d1d8bc6075d03a07ed28a53487a92780.exe
File created	C:\Windows\SysWOW64\macromd\kill osama bin laden game.exe	NEAS.d1d8bc6075d03a07ed28a53487a92780.exe
File created	C:\Windows\SysWOW64\macromd\invisible IP.exe	NEAS.d1d8bc6075d03a07ed28a53487a92780.exe
File created	C:\Windows\SysWOW64\macromd\16 year old webcam.mpg.exe	NEAS.d1d8bc6075d03a07ed28a53487a92780.exe
File created	C:\Windows\SysWOW64\macromd\crack.exe	NEAS.d1d8bc6075d03a07ed28a53487a92780.exe
File created	C:\Windows\SysWOW64\macromd\14 year old on beach.mpg.exe	NEAS.d1d8bc6075d03a07ed28a53487a92780.exe
File created	C:\Windows\SysWOW64\macromd\AOL, MSN, Yahoo mail password stealer.exe	NEAS.d1d8bc6075d03a07ed28a53487a92780.exe
File created	C:\Windows\SysWOW64\macromd\Pamela Anderson.exe	NEAS.d1d8bc6075d03a07ed28a53487a92780.exe
File created	C:\Windows\SysWOW64\macromd\GTA 3 Serial.exe	NEAS.d1d8bc6075d03a07ed28a53487a92780.exe
File created	C:\Windows\SysWOW64\macromd\Grand theft auto 3 CD1 crack.exe	NEAS.d1d8bc6075d03a07ed28a53487a92780.exe
File created	C:\Windows\SysWOW64\macromd\Yahoo mail cracker.exe	NEAS.d1d8bc6075d03a07ed28a53487a92780.exe
File created	C:\Windows\SysWOW64\macromd\aimhacker.exe	NEAS.d1d8bc6075d03a07ed28a53487a92780.exe
File created	C:\Windows\SysWOW64\winxcfg.exe	NEAS.d1d8bc6075d03a07ed28a53487a92780.exe
File created	C:\Windows\SysWOW64\macromd\Another bang bus victim forced rape sex cum.mpg.exe	NEAS.d1d8bc6075d03a07ed28a53487a92780.exe
File created	C:\Windows\SysWOW64\macromd\Britney spears nude.exe	NEAS.d1d8bc6075d03a07ed28a53487a92780.exe
File created	C:\Windows\SysWOW64\macromd\preteen snuff sex rape with a stick hardcore.mpg.pif	NEAS.d1d8bc6075d03a07ed28a53487a92780.exe
File created	C:\Windows\SysWOW64\macromd\girls gone wild.mpg.exe	NEAS.d1d8bc6075d03a07ed28a53487a92780.exe
File created	C:\Windows\SysWOW64\macromd\chubby girl bukkake gang banged sucking cock.mpg.pif	NEAS.d1d8bc6075d03a07ed28a53487a92780.exe
File created	C:\Windows\SysWOW64\macromd\illegal porno - 15 year old raped by two men on boat.mpg.pif	NEAS.d1d8bc6075d03a07ed28a53487a92780.exe
File created	C:\Windows\SysWOW64\macromd\Napster Clone.exe	NEAS.d1d8bc6075d03a07ed28a53487a92780.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.d1d8bc6075d03a07ed28a53487a92780.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.d1d8bc6075d03a07ed28a53487a92780.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\macromd\Britney Spears Dance Beat.exe

Filesize
62KB

MD5
76342eae02e246f31aa3286598badc12

SHA1
b3b1a739333f6c2a0f722efe9d0caffcf24cce06

SHA256
a51ab1f65a3bbd0885ed6d161e6a3b875641c507bbf37f747cb40737a705da10

SHA512
127fd9f075ce7f90f117eab37d90c3ea001d94555aaf314068639cb3c6f269dd0238cbf6c0e8bc2e76ca116709a5c9380accd40e4d274cc9c53ed5355e58d498

Download Submit
memory/2320-0-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2320-28-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads