d4c49d31ca3aee3851b3996b5911583f700dc164ec75b56ec721f8b4aedc554b

Analysis

max time kernel
139s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2023, 09:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NEAS.8a8837075245ff977b6f33faada202f0_JC.exe
Size 184KB
Sample231104-kyf3vaed3v
SHA256 d4c49d31ca3aee3851b3996b5911583f700dc164ec75b56ec721f8b4aedc554b
MD5 8a8837075245ff977b6f33faada202f0
SHA1 4c2b5cd7bd9cc9d93335b7d2e3011c011261aeab
SHA512 f70ae0e48b70ec29eaff0ca3c1f8ddb107619e0510c53a418d5f146373920aae84cefe75d31e2438b2a57c61a78cdba4185d489f78852e228e4f514d9e3b75fc
SSDEEP 3072:uJfuq8IzyLHID/p8iJDAAkRcpm1Kcwdx8MEqRhlQaBkcHTZlhAJzdyk:uuq1yy/pjnkWcLQQiHZ+zv
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2124-0-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/files/0x0007000000022df8-6.dat	upx
behavioral2/memory/2124-17-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/memory/2124-18-0x0000000000400000-0x0000000000418000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\MzvCGZOraXa.com	NEAS.8a8837075245ff977b6f33faada202f0_JC.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win32dc\Counter-Strike patch.exe	NEAS.8a8837075245ff977b6f33faada202f0_JC.exe
File created	C:\Windows\win32dc\Half-Life 2_nocd.exe	NEAS.8a8837075245ff977b6f33faada202f0_JC.exe
File opened for modification	C:\Windows\win32dc\Half-Life 2_nocd.exe	NEAS.8a8837075245ff977b6f33faada202f0_JC.exe
File created	C:\Windows\win32dc\UT2004_cdfix.exe	NEAS.8a8837075245ff977b6f33faada202f0_JC.exe
File opened for modification	C:\Windows\win32dc\Counter-Strike + serial.exe	NEAS.8a8837075245ff977b6f33faada202f0_JC.exe
File created	C:\Windows\win32dc\FlatOut(serial).exe	NEAS.8a8837075245ff977b6f33faada202f0_JC.exe
File created	C:\Windows\win32dc\Counter-Strike_codes.exe	NEAS.8a8837075245ff977b6f33faada202f0_JC.exe
File opened for modification	C:\Windows\win32dc\Counter-Strike_codes.exe	NEAS.8a8837075245ff977b6f33faada202f0_JC.exe
File created	C:\Windows\win32dc\Counter-Strike patch.exe	NEAS.8a8837075245ff977b6f33faada202f0_JC.exe
File created	C:\Windows\win32dc\BattleField 1942 + crack.exe	NEAS.8a8837075245ff977b6f33faada202f0_JC.exe
File opened for modification	C:\Windows\win32dc\Quake3(cdfix).exe	NEAS.8a8837075245ff977b6f33faada202f0_JC.exe
File opened for modification	C:\Windows\win32dc\Doom 3 + codes.exe	NEAS.8a8837075245ff977b6f33faada202f0_JC.exe
File created	C:\Windows\win32dc\Counter-Strike + serial.exe	NEAS.8a8837075245ff977b6f33faada202f0_JC.exe
File created	C:\Windows\win32dc\Quake3(cdfix).exe	NEAS.8a8837075245ff977b6f33faada202f0_JC.exe
File created	C:\Windows\win32dc\Doom 3 + codes.exe	NEAS.8a8837075245ff977b6f33faada202f0_JC.exe
File created	C:\Windows\win32dc\Sims 2_codes.exe	NEAS.8a8837075245ff977b6f33faada202f0_JC.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.8a8837075245ff977b6f33faada202f0_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.8a8837075245ff977b6f33faada202f0_JC.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:2124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Quake3(cdfix).exe

Path C:\Windows\win32dc\Quake3(cdfix).exe
Size 187KB
SHA256 a9601f4336f75b5d3378aecaec05ec5d801781d8eb6acec08c0cd0a327bf97c1
MD5 ea1d62503aa19084dd8adc582c39d9ad
SHA1 94bd6e32f0d40436645f4b89e0f3f7d6c0ccfa51
SHA512 5a5fc06872b20bb3cae7ac7dfedb1678d6154938ef2378e09545bd9055fcc421644a0da1b9720d5722a6045a934309c837577e4f6c9f426f6cfdf8b0b33e8966
SSDEEP 3072:uJfuq8IzyLHID/p8iJDAAkRcpm1Kcwdx8MEqRhlQaBkcHTZlhAJzdyI:uuq1yy/pjnkWcLQQiHZ+z5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2124-0-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/2124-17-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/2124-18-0x0000000000400000-0x0000000000418000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads