599f402ab160957ce22a01bf711d2349868f5b5cc1d799da98d6bffb4d7af29a

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
03/11/2023, 04:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.c4fdd9d98d466a51d834f83ef9c6b6a0_JC.exe
Size

297KB
MD5

c4fdd9d98d466a51d834f83ef9c6b6a0
SHA1

af027efc8881c576505dfd03c5d75780a1e1b173
SHA256

599f402ab160957ce22a01bf711d2349868f5b5cc1d799da98d6bffb4d7af29a
SHA512

ceca3543f21fda53bf67eb919e749d7c1ed861a8a218954d4a51260fcc830d2f1f21724a5cf0df3f373471b6af428a6cfbf0228ad4d02178031c37c2166f1f8f
SSDEEP

6144:uuq1yy/pjnkWcLkONgMDGMHTiLCwKurwdw9mJRQdkAK:y1yc9kWc4u7DGMyCdgmJRC2

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2260-0-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/files/0x0007000000022d5f-5.dat	upx
behavioral2/memory/2260-21-0x0000000000400000-0x0000000000418000-memory.dmp	upx

Drops file in Windows directory 20 IoCs

description	ioc	Process
File created	C:\Windows\win32dc\DAoC + trainer.exe	NEAS.c4fdd9d98d466a51d834f83ef9c6b6a0_JC.exe
File opened for modification	C:\Windows\win32dc\DAoC + trainer.exe	NEAS.c4fdd9d98d466a51d834f83ef9c6b6a0_JC.exe
File created	C:\Windows\win32dc\Silent Hill 4_cdfix.exe	NEAS.c4fdd9d98d466a51d834f83ef9c6b6a0_JC.exe
File opened for modification	C:\Windows\win32dc\BattleField 1942 hack.exe	NEAS.c4fdd9d98d466a51d834f83ef9c6b6a0_JC.exe
File created	C:\Windows\win32dc\Doom 3 patch.exe	NEAS.c4fdd9d98d466a51d834f83ef9c6b6a0_JC.exe
File opened for modification	C:\Windows\win32dc\Quake3 fix.exe	NEAS.c4fdd9d98d466a51d834f83ef9c6b6a0_JC.exe
File created	C:\Windows\win32dc\FlatOut_nocd.exe	NEAS.c4fdd9d98d466a51d834f83ef9c6b6a0_JC.exe
File opened for modification	C:\Windows\win32dc\FlatOut_nocd.exe	NEAS.c4fdd9d98d466a51d834f83ef9c6b6a0_JC.exe
File opened for modification	C:\Windows\win32dc\FlatOut_patch.exe	NEAS.c4fdd9d98d466a51d834f83ef9c6b6a0_JC.exe
File opened for modification	C:\Windows\win32dc\Silent Hill 4 + cdfix.exe	NEAS.c4fdd9d98d466a51d834f83ef9c6b6a0_JC.exe
File opened for modification	C:\Windows\win32dc\Sims 2_crack.exe	NEAS.c4fdd9d98d466a51d834f83ef9c6b6a0_JC.exe
File created	C:\Windows\win32dc\BattleField 1942 hack.exe	NEAS.c4fdd9d98d466a51d834f83ef9c6b6a0_JC.exe
File opened for modification	C:\Windows\win32dc\Doom 3 patch.exe	NEAS.c4fdd9d98d466a51d834f83ef9c6b6a0_JC.exe
File created	C:\Windows\win32dc\Silent Hill 4 + cdfix.exe	NEAS.c4fdd9d98d466a51d834f83ef9c6b6a0_JC.exe
File created	C:\Windows\win32dc\FlatOut_patch.exe	NEAS.c4fdd9d98d466a51d834f83ef9c6b6a0_JC.exe
File created	C:\Windows\win32dc\Silent Hill 4_patch.exe	NEAS.c4fdd9d98d466a51d834f83ef9c6b6a0_JC.exe
File opened for modification	C:\Windows\win32dc\Silent Hill 4_patch.exe	NEAS.c4fdd9d98d466a51d834f83ef9c6b6a0_JC.exe
File opened for modification	C:\Windows\win32dc\Silent Hill 4_cdfix.exe	NEAS.c4fdd9d98d466a51d834f83ef9c6b6a0_JC.exe
File created	C:\Windows\win32dc\Sims 2_crack.exe	NEAS.c4fdd9d98d466a51d834f83ef9c6b6a0_JC.exe
File created	C:\Windows\win32dc\Quake3 fix.exe	NEAS.c4fdd9d98d466a51d834f83ef9c6b6a0_JC.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.c4fdd9d98d466a51d834f83ef9c6b6a0_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.c4fdd9d98d466a51d834f83ef9c6b6a0_JC.exe"
1⤵
- Drops file in Windows directory
PID:2260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win32dc\FlatOut_nocd.exe

Filesize
299KB

MD5
ed6d7011c485467bd74d567e80fda42a

SHA1
6f40e93ba5c1196691a7329fa5057cbd6c651b9a

SHA256
56bdab574f535f88bd489661b87a77436cbf97b3b8e2905e30d82dd3fc83d079

SHA512
3ab2e61b0582c216e93f815036a563b6aaa44da463b1b25cd85ed799110a929e28752d2342caeaef9a9adfd682555cb6af7a96d3327704dd29c089950d022848

Download Submit
memory/2260-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2260-21-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads