1a8c1ec3dcc7cf3edee454027254127e779c58184455e151b64a59dfa9d1675d

Analysis

max time kernel
121s
max time network
132s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
01-11-2023 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.0888677c9adbcece2644e1286612e640_JC.exe
Size

112KB
MD5

0888677c9adbcece2644e1286612e640
SHA1

758cdc1afa4d75062d003a84483f9f45ebe7c0d8
SHA256

1a8c1ec3dcc7cf3edee454027254127e779c58184455e151b64a59dfa9d1675d
SHA512

132aade2c076cd487babd7fab7b064e4ca97a705ab948f628b9b504f5b849370e668faca03dc9cbb3173ad1fe5d2fed924afcd3cff100eb6d3e3b754e96c9cc2
SSDEEP

3072:1ZduCcp8iJUAAkRsQ4IVgCxvQ4VIaxo127smTwnsq:1qp0nkeQ4mxvQ4VI7o4sq

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1976-0-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/files/0x0008000000015c9d-5.dat	upx
behavioral1/memory/1976-17-0x0000000000400000-0x0000000000417000-memory.dmp	upx

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\win32dc\DAoC + codes.exe	NEAS.0888677c9adbcece2644e1286612e640_JC.exe
File opened for modification	C:\Windows\win32dc\Half-Life 2 + codes.exe	NEAS.0888677c9adbcece2644e1286612e640_JC.exe
File created	C:\Windows\win32dc\FlatOut hack.exe	NEAS.0888677c9adbcece2644e1286612e640_JC.exe
File created	C:\Windows\win32dc\FlatOut serial.exe	NEAS.0888677c9adbcece2644e1286612e640_JC.exe
File opened for modification	C:\Windows\win32dc\UT2004(nocd).exe	NEAS.0888677c9adbcece2644e1286612e640_JC.exe
File created	C:\Windows\win32dc\Doom 3(codes).exe	NEAS.0888677c9adbcece2644e1286612e640_JC.exe
File created	C:\Windows\win32dc\Half-Life 2 + codes.exe	NEAS.0888677c9adbcece2644e1286612e640_JC.exe
File created	C:\Windows\win32dc\UT2004(nocd).exe	NEAS.0888677c9adbcece2644e1286612e640_JC.exe
File created	C:\Windows\win32dc\Counter-Strike + fix.exe	NEAS.0888677c9adbcece2644e1286612e640_JC.exe
File opened for modification	C:\Windows\win32dc\Counter-Strike + fix.exe	NEAS.0888677c9adbcece2644e1286612e640_JC.exe
File opened for modification	C:\Windows\win32dc\DAoC + codes.exe	NEAS.0888677c9adbcece2644e1286612e640_JC.exe
File created	C:\Windows\win32dc\Quake3 + cdfix.exe	NEAS.0888677c9adbcece2644e1286612e640_JC.exe
File opened for modification	C:\Windows\win32dc\Quake3 + cdfix.exe	NEAS.0888677c9adbcece2644e1286612e640_JC.exe
File created	C:\Windows\win32dc\BattleField 1942(cheat).exe	NEAS.0888677c9adbcece2644e1286612e640_JC.exe
File created	C:\Windows\win32dc\FlatOut(fix).exe	NEAS.0888677c9adbcece2644e1286612e640_JC.exe
File opened for modification	C:\Windows\win32dc\FlatOut serial.exe	NEAS.0888677c9adbcece2644e1286612e640_JC.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.0888677c9adbcece2644e1286612e640_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.0888677c9adbcece2644e1286612e640_JC.exe"
1⤵
- Drops file in Windows directory
PID:1976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win32dc\Doom 3(codes).exe

Filesize
112KB

MD5
0888677c9adbcece2644e1286612e640

SHA1
758cdc1afa4d75062d003a84483f9f45ebe7c0d8

SHA256
1a8c1ec3dcc7cf3edee454027254127e779c58184455e151b64a59dfa9d1675d

SHA512
132aade2c076cd487babd7fab7b064e4ca97a705ab948f628b9b504f5b849370e668faca03dc9cbb3173ad1fe5d2fed924afcd3cff100eb6d3e3b754e96c9cc2

Download Submit
memory/1976-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1976-17-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads