e52400988a07ce80c2b963cff043e868dcd58b804304e878c882dd398c94a418

General

Target

NEAS.afc0e8ca805126afea6a435f63a87820.exe
Size

210KB
MD5

afc0e8ca805126afea6a435f63a87820
SHA1

e85b1556917ae98d63ad0d2271caa33c1489c03a
SHA256

e52400988a07ce80c2b963cff043e868dcd58b804304e878c882dd398c94a418
SHA512

4d4dad888ff21a27c77738d96781b53b220642a6f1dbf54edb5ed6a5855e7a8205c21779a1dcfc9d3d97714bff5b3fa71d236a5f114e6c2d8600ae9e535c8e49
SSDEEP

3072:KhS7VD4/EnzzMUD8u8EC45xRS5b7lIf3GYHfqR1hAtTD5DyXglREK0c2:dOizzb8uDxZCHlIZgEh5DyXglh

Score

7^/10

aspackv2 persistence

Malware Config

Signatures

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0006000000022e0c-10.dat	aspack_v212_v242
behavioral2/files/0x0008000000022ded-19.dat	aspack_v212_v242
behavioral2/files/0x0008000000022ded-20.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4756	SKH.EXE

Modifies system executable filetype association 2 TTPs 3 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	NEAS.afc0e8ca805126afea6a435f63a87820.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\PQCMYR.EXE \"%1\" %*"	NEAS.afc0e8ca805126afea6a435f63a87820.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	SKH.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PRK.EXE = "C:\\Users\\EOIGQQ.EXE"	NEAS.afc0e8ca805126afea6a435f63a87820.exe

Enumerates connected drives 3 TTPs 17 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	NEAS.afc0e8ca805126afea6a435f63a87820.exe
File opened (read-only)	\??\V:	NEAS.afc0e8ca805126afea6a435f63a87820.exe
File opened (read-only)	\??\N:	NEAS.afc0e8ca805126afea6a435f63a87820.exe
File opened (read-only)	\??\S:	NEAS.afc0e8ca805126afea6a435f63a87820.exe
File opened (read-only)	\??\R:	NEAS.afc0e8ca805126afea6a435f63a87820.exe
File opened (read-only)	\??\E:	NEAS.afc0e8ca805126afea6a435f63a87820.exe
File opened (read-only)	\??\K:	NEAS.afc0e8ca805126afea6a435f63a87820.exe
File opened (read-only)	\??\I:	NEAS.afc0e8ca805126afea6a435f63a87820.exe
File opened (read-only)	\??\J:	NEAS.afc0e8ca805126afea6a435f63a87820.exe
File opened (read-only)	\??\M:	NEAS.afc0e8ca805126afea6a435f63a87820.exe
File opened (read-only)	\??\O:	NEAS.afc0e8ca805126afea6a435f63a87820.exe
File opened (read-only)	\??\G:	NEAS.afc0e8ca805126afea6a435f63a87820.exe
File opened (read-only)	\??\H:	NEAS.afc0e8ca805126afea6a435f63a87820.exe
File opened (read-only)	\??\Q:	NEAS.afc0e8ca805126afea6a435f63a87820.exe
File opened (read-only)	\??\T:	NEAS.afc0e8ca805126afea6a435f63a87820.exe
File opened (read-only)	\??\L:	NEAS.afc0e8ca805126afea6a435f63a87820.exe
File opened (read-only)	\??\P:	NEAS.afc0e8ca805126afea6a435f63a87820.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "C:\\Users\\XBXDWN.EXE \"%1\""	NEAS.afc0e8ca805126afea6a435f63a87820.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command	NEAS.afc0e8ca805126afea6a435f63a87820.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command	NEAS.afc0e8ca805126afea6a435f63a87820.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell	NEAS.afc0e8ca805126afea6a435f63a87820.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open	NEAS.afc0e8ca805126afea6a435f63a87820.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	NEAS.afc0e8ca805126afea6a435f63a87820.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\chm.file	NEAS.afc0e8ca805126afea6a435f63a87820.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open\command	NEAS.afc0e8ca805126afea6a435f63a87820.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command	NEAS.afc0e8ca805126afea6a435f63a87820.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command\ = "C:\\PerfLogs\\ENBN.EXE %1"	NEAS.afc0e8ca805126afea6a435f63a87820.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Users\\XBXDWN.EXE %1"	NEAS.afc0e8ca805126afea6a435f63a87820.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command	NEAS.afc0e8ca805126afea6a435f63a87820.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\PQCMYR.EXE \"%1\" %*"	NEAS.afc0e8ca805126afea6a435f63a87820.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	SKH.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "C:\\Users\\XBXDWN.EXE \"%1\""	NEAS.afc0e8ca805126afea6a435f63a87820.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4756	SKH.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 4756	1616	NEAS.afc0e8ca805126afea6a435f63a87820.exe	87
PID 1616 wrote to memory of 4756	1616	NEAS.afc0e8ca805126afea6a435f63a87820.exe	87
PID 1616 wrote to memory of 4756	1616	NEAS.afc0e8ca805126afea6a435f63a87820.exe	87

C:\Users\Admin\AppData\Local\Temp\NEAS.afc0e8ca805126afea6a435f63a87820.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.afc0e8ca805126afea6a435f63a87820.exe"
1⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1616
- C:\odt\SKH.EXE
  C:\odt\SKH.EXE
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\XBXDWN.EXE

Filesize
211KB

MD5
6de114fe5a09b83ecf392a83d25d350a

SHA1
937cb6f9bd32afa0921ef8badca9e5baa0ef9989

SHA256
f5de191d7c6dec75f626dd07d6f985223225f2efb3f705922a2c63c6402c1f16

SHA512
af1e87c4489d79f2f0716e65ce62f9c9eccff8177f78dbe5be839174db9b4edf0e4d9094ded41e6902db66827ed281f439a7e75572e63eaa55b2f081f3ce94d2

Download Submit
C:\odt\SKH.EXE

Filesize
211KB

MD5
3994411261b7b090d3d44faa01117c99

SHA1
f8a23a98ef0c809eb449f2d0d30963336402bdee

SHA256
d7599f6b93c81965a04c435f4c6879fc117feae514145fe8df25f67335340e1c

SHA512
981c8b097c9a0374fa16fe26ce80ad1a40a3ebe5c293c906959b38a5e206ea09330702fdbad7ce6af9f295023a20e9a24d01cde140b487b85e39d0554568c37c

Download Submit
C:\odt\SKH.EXE

Filesize
211KB

MD5
3994411261b7b090d3d44faa01117c99

SHA1
f8a23a98ef0c809eb449f2d0d30963336402bdee

SHA256
d7599f6b93c81965a04c435f4c6879fc117feae514145fe8df25f67335340e1c

SHA512
981c8b097c9a0374fa16fe26ce80ad1a40a3ebe5c293c906959b38a5e206ea09330702fdbad7ce6af9f295023a20e9a24d01cde140b487b85e39d0554568c37c

Download Submit
memory/1616-0-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/1616-21-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4756-26-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/4756-24-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4756-25-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4756-22-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/4756-27-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4756-29-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4756-30-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4756-31-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4756-33-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4756-34-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4756-35-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4756-36-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4756-37-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads