0ca0ca7763b472e60255ac6936ec4c964221e2cfed20ccfc780ccbe6949491e7

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
16/10/2023, 18:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.371d23f77f9388db226dce96c462d6e0.exe
Size

227KB
MD5

371d23f77f9388db226dce96c462d6e0
SHA1

953a043ba43702953b899903e382b918cc8e20b2
SHA256

0ca0ca7763b472e60255ac6936ec4c964221e2cfed20ccfc780ccbe6949491e7
SHA512

a48922b29a48ab816eb32faf13566fa6f5283ef1aac2a31ea38272d3a4451062abe40062b2fd5314335fe4aa2aab4003100b298e5d3bb4cf1b4311c313528664
SSDEEP

6144:Ouq1yyfpenkeQ4owfU/bJHf1/Q5mXSjMJ:S1yoMkbnw8/9HN/tSjMJ

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5080-0-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/files/0x000600000002323d-5.dat	upx
behavioral2/memory/5080-17-0x0000000000400000-0x0000000000418000-memory.dmp	upx

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win32dc\Sims 2(serial).exe	NEAS.371d23f77f9388db226dce96c462d6e0.exe
File opened for modification	C:\Windows\win32dc\Sims 2 + crack.exe	NEAS.371d23f77f9388db226dce96c462d6e0.exe
File created	C:\Windows\win32dc\UT2004 cheat.exe	NEAS.371d23f77f9388db226dce96c462d6e0.exe
File created	C:\Windows\win32dc\Quake3 + hack.exe	NEAS.371d23f77f9388db226dce96c462d6e0.exe
File opened for modification	C:\Windows\win32dc\BattleField 1942_fix.exe	NEAS.371d23f77f9388db226dce96c462d6e0.exe
File created	C:\Windows\win32dc\DAoC cheat.exe	NEAS.371d23f77f9388db226dce96c462d6e0.exe
File opened for modification	C:\Windows\win32dc\DAoC cheat.exe	NEAS.371d23f77f9388db226dce96c462d6e0.exe
File opened for modification	C:\Windows\win32dc\Quake3_nocd.exe	NEAS.371d23f77f9388db226dce96c462d6e0.exe
File created	C:\Windows\win32dc\BattleField 1942 + serial.exe	NEAS.371d23f77f9388db226dce96c462d6e0.exe
File opened for modification	C:\Windows\win32dc\BattleField 1942 + serial.exe	NEAS.371d23f77f9388db226dce96c462d6e0.exe
File created	C:\Windows\win32dc\Sims 2 + crack.exe	NEAS.371d23f77f9388db226dce96c462d6e0.exe
File created	C:\Windows\win32dc\Quake3_nocd.exe	NEAS.371d23f77f9388db226dce96c462d6e0.exe
File created	C:\Windows\win32dc\DAoC(cheat).exe	NEAS.371d23f77f9388db226dce96c462d6e0.exe
File created	C:\Windows\win32dc\Sims 2(serial).exe	NEAS.371d23f77f9388db226dce96c462d6e0.exe
File created	C:\Windows\win32dc\Half-Life 2 trainer.exe	NEAS.371d23f77f9388db226dce96c462d6e0.exe
File opened for modification	C:\Windows\win32dc\Half-Life 2 trainer.exe	NEAS.371d23f77f9388db226dce96c462d6e0.exe
File created	C:\Windows\win32dc\BattleField 1942_fix.exe	NEAS.371d23f77f9388db226dce96c462d6e0.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.371d23f77f9388db226dce96c462d6e0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.371d23f77f9388db226dce96c462d6e0.exe"
1⤵
- Drops file in Windows directory
PID:5080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win32dc\Half-Life 2 trainer.exe

Filesize
229KB

MD5
10278eaa739b76b946d8360602a13b3e

SHA1
7e6aae71de089ad7b3c7ecd92c7b011797ad0c73

SHA256
b0919acbbfd6667acd3f5b857553e3d8e901037ad1d1a1e8dd930741ec991c97

SHA512
86584a1cb2dfe0687a7fd49e16d3065b6593f70a37420dd0ea7060d9a20031327bfc46e32572861d129b956e1b748df2c70c87cb096761d1c8ac808c9f5e9b59

Download Submit
memory/5080-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/5080-17-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads