Analysis
-
max time kernel
60s -
max time network
64s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
18/10/2023, 17:48 UTC
General
-
Target
Hades v1.0-v1.38 Plus 15 Trainer x64.exe
-
Size
1.4MB
-
MD5
d6af8282fe43619a2854dcbb062e5fc5
-
SHA1
fa2f9972ef8fd64cdbce1764f5846aed1e644973
-
SHA256
41ce8c8837bc90a3097417346b5e96616a73b34cd00b1d79d90cb9bdeb29c83f
-
SHA512
db84040f8ee47bc14b00b1690471a1445e09633252894a31116e24b5061450dee687b47e164bdd58f019edaa2b8e233017829b5260d2e0ce7724910f63ba8734
-
SSDEEP
24576:N9/QSW61N8Lqpgz7R0Ahn5nRQfbJ7MiYPDS/:OeyepURPh5nRQfV7
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Hades v1.0-v1.38 Plus 15 Trainer x64.exe"C:\Users\Admin\AppData\Local\Temp\Hades v1.0-v1.38 Plus 15 Trainer x64.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
-
DNS158.240.127.40.in-addr.arpaRemote address:8.8.8.8:53Request158.240.127.40.in-addr.arpaIN PTRResponse -
DNS8.3.197.209.in-addr.arpaRemote address:8.8.8.8:53Request8.3.197.209.in-addr.arpaIN PTRResponse8.3.197.209.in-addr.arpaIN PTRvip0x008map2sslhwcdnnet
-
DNS64.159.190.20.in-addr.arpaRemote address:8.8.8.8:53Request64.159.190.20.in-addr.arpaIN PTRResponse
-
DNS108.211.229.192.in-addr.arpaRemote address:8.8.8.8:53Request108.211.229.192.in-addr.arpaIN PTRResponse
-
DNSflingtrainer.comRemote address:8.8.8.8:53Requestflingtrainer.comIN AResponseflingtrainer.comIN A188.114.96.0flingtrainer.comIN A188.114.97.0
-
GEThttps://flingtrainer.com/wp-content/check-for-trainer-update/hades-trainerRemote address:188.114.96.0:443RequestGET /wp-content/check-for-trainer-update/hades-trainer HTTP/1.1
User-Agent: FLiNGTrainer
Host: flingtrainer.com
ResponseHTTP/1.1 200 OK
Date: Wed, 18 Oct 2023 17:49:15 GMT
Content-Length: 11
Connection: keep-alive
last-modified: Fri, 03 Sep 2021 00:43:16 GMT
etag: "b-5cb0c95c03100"
accept-ranges: bytes
Cache-Control: no-cache, no-store, must-revalidate
pragma: no-cache
expires: 0
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0EhycDwo0%2FpTJ1Dum5O0wy%2FABAFL0rI2cAxDofODTYIsPI7Uw0naHGgivOZI0ejHR5LbOycofPpTKKXA%2FhamVBr8kfvD3jn7OTFkL6HoeoJWycPUU9hsosOihFsl9olaQ319"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 81829deb6b2866b4-AMS
alt-svc: h3=":443"; ma=86400
-
DNSx2.c.lencr.orgRemote address:8.8.8.8:53Requestx2.c.lencr.orgIN AResponsex2.c.lencr.orgIN CNAMEcrl.root-x1.letsencrypt.org.edgekey.netcrl.root-x1.letsencrypt.org.edgekey.netIN CNAMEe8652.dscx.akamaiedge.nete8652.dscx.akamaiedge.netIN A23.42.174.147
-
GEThttp://x2.c.lencr.org/Remote address:23.42.174.147:80RequestGET / HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: x2.c.lencr.org
ResponseHTTP/1.1 200 OK
Server: nginx
Content-Type: application/pkix-crl
Last-Modified: Fri, 04 Aug 2023 20:57:56 GMT
ETag: "64cd6654-12c"
Cache-Control: max-age=3600
Expires: Wed, 18 Oct 2023 18:49:15 GMT
Date: Wed, 18 Oct 2023 17:49:15 GMT
Content-Length: 300
Connection: keep-alive
-
DNS0.96.114.188.in-addr.arpaRemote address:8.8.8.8:53Request0.96.114.188.in-addr.arpaIN PTRResponse
-
DNS147.174.42.23.in-addr.arpaRemote address:8.8.8.8:53Request147.174.42.23.in-addr.arpaIN PTRResponse147.174.42.23.in-addr.arpaIN PTRa23-42-174-147deploystaticakamaitechnologiescom
-
DNS146.78.124.51.in-addr.arpaRemote address:8.8.8.8:53Request146.78.124.51.in-addr.arpaIN PTRResponse
-
DNS2.136.104.51.in-addr.arpaRemote address:8.8.8.8:53Request2.136.104.51.in-addr.arpaIN PTRResponse
-
DNS26.165.165.52.in-addr.arpaRemote address:8.8.8.8:53Request26.165.165.52.in-addr.arpaIN PTRResponse
-
DNS15.164.165.52.in-addr.arpaRemote address:8.8.8.8:53Request15.164.165.52.in-addr.arpaIN PTRResponse
-
DNS113.208.253.8.in-addr.arpaRemote address:8.8.8.8:53Request113.208.253.8.in-addr.arpaIN PTRResponse
-
188.114.96.0:443https://flingtrainer.com/wp-content/check-for-trainer-update/hades-trainertls, http
HTTP Request
GET https://flingtrainer.com/wp-content/check-for-trainer-update/hades-trainerHTTP Response
200 -
23.42.174.147:80http://x2.c.lencr.org/http
HTTP Request
GET http://x2.c.lencr.org/HTTP Response
200
-
8.8.8.8:53158.240.127.40.in-addr.arpadns
DNS Request
158.240.127.40.in-addr.arpa
-
8.8.8.8:538.3.197.209.in-addr.arpadns
DNS Request
8.3.197.209.in-addr.arpa
-
8.8.8.8:5364.159.190.20.in-addr.arpadns
DNS Request
64.159.190.20.in-addr.arpa
-
8.8.8.8:53108.211.229.192.in-addr.arpadns
DNS Request
108.211.229.192.in-addr.arpa
-
8.8.8.8:53flingtrainer.comdns
DNS Request
flingtrainer.com
DNS Response
188.114.96.0188.114.97.0
-
8.8.8.8:53x2.c.lencr.orgdns
DNS Request
x2.c.lencr.org
DNS Response
23.42.174.147
-
8.8.8.8:530.96.114.188.in-addr.arpadns
DNS Request
0.96.114.188.in-addr.arpa
-
8.8.8.8:53147.174.42.23.in-addr.arpadns
DNS Request
147.174.42.23.in-addr.arpa
-
8.8.8.8:53146.78.124.51.in-addr.arpadns
DNS Request
146.78.124.51.in-addr.arpa
-
8.8.8.8:532.136.104.51.in-addr.arpadns
DNS Request
2.136.104.51.in-addr.arpa
-
8.8.8.8:5326.165.165.52.in-addr.arpadns
DNS Request
26.165.165.52.in-addr.arpa
-
8.8.8.8:5315.164.165.52.in-addr.arpadns
DNS Request
15.164.165.52.in-addr.arpa
-
8.8.8.8:53113.208.253.8.in-addr.arpadns
DNS Request
113.208.253.8.in-addr.arpa
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
200KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB