37b054eb93b2ea45a7335824dc5bde03df5e724fffddc9c05e07f80158466889

General

Target

3e13b646fd329e18eee2017b21f04458.exe
Size

563KB
MD5

3e13b646fd329e18eee2017b21f04458
SHA1

bfa7105023d30a42b9cfbdfa3ce7e8359f96bd55
SHA256

37b054eb93b2ea45a7335824dc5bde03df5e724fffddc9c05e07f80158466889
SHA512

54078e0411b8191ffaa5f5bcff4ca6c865c69ab7feac6cda26e51d7826d36ee5f0bad2df2b1004775d914ebb1ffa603c6f87b931c8a5f5db9cfd38783ae576cf
SSDEEP

6144:5dkkkkkkb4x15dkkkkkkb4x1BaAXryW8dkkkkkkb4x15dkkkkkkb4x1BaAXryW6L:5J4xzJ4x3yW8J4xzJ4x3yWgx

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/816-0-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/816-1-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/files/0x0008000000014b9a-6.dat	upx
behavioral1/memory/816-20-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/816-21-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/816-22-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/816-23-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/816-24-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/816-25-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/816-26-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/816-27-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/816-28-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/816-29-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/816-30-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/816-31-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/816-32-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Drops file in Windows directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win32dc\Doom 3_codes.exe	3e13b646fd329e18eee2017b21f04458.exe
File opened for modification	C:\Windows\win32dc\FlatOut(fix).exe	3e13b646fd329e18eee2017b21f04458.exe
File created	C:\Windows\win32dc\Half-Life 2 + serial.exe	3e13b646fd329e18eee2017b21f04458.exe
File opened for modification	C:\Windows\win32dc\BattleField 1942 trainer.exe	3e13b646fd329e18eee2017b21f04458.exe
File opened for modification	C:\Windows\win32dc\Silent Hill 4(serial).exe	3e13b646fd329e18eee2017b21f04458.exe
File created	C:\Windows\win32dc\Quake3 nocd.exe	3e13b646fd329e18eee2017b21f04458.exe
File opened for modification	C:\Windows\win32dc\Quake3 nocd.exe	3e13b646fd329e18eee2017b21f04458.exe
File opened for modification	C:\Windows\win32dc\FlatOut_trainer.exe	3e13b646fd329e18eee2017b21f04458.exe
File created	C:\Windows\win32dc\BattleField 1942 trainer.exe	3e13b646fd329e18eee2017b21f04458.exe
File created	C:\Windows\win32dc\Half-Life 2 hack.exe	3e13b646fd329e18eee2017b21f04458.exe
File opened for modification	C:\Windows\win32dc\Half-Life 2 hack.exe	3e13b646fd329e18eee2017b21f04458.exe
File created	C:\Windows\win32dc\Doom 3 + cdfix.exe	3e13b646fd329e18eee2017b21f04458.exe
File created	C:\Windows\win32dc\Doom 3_codes.exe	3e13b646fd329e18eee2017b21f04458.exe
File created	C:\Windows\win32dc\FlatOut(fix).exe	3e13b646fd329e18eee2017b21f04458.exe
File created	C:\Windows\win32dc\FlatOut_trainer.exe	3e13b646fd329e18eee2017b21f04458.exe
File created	C:\Windows\win32dc\Silent Hill 4(serial).exe	3e13b646fd329e18eee2017b21f04458.exe
File created	C:\Windows\win32dc\Half-Life 2_serial.exe	3e13b646fd329e18eee2017b21f04458.exe
File opened for modification	C:\Windows\win32dc\Half-Life 2_serial.exe	3e13b646fd329e18eee2017b21f04458.exe

C:\Users\Admin\AppData\Local\Temp\3e13b646fd329e18eee2017b21f04458.exe
"C:\Users\Admin\AppData\Local\Temp\3e13b646fd329e18eee2017b21f04458.exe"
1⤵
- Drops file in Windows directory
PID:816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win32dc\Doom 3 + cdfix.exe

Filesize
563KB

MD5
3e13b646fd329e18eee2017b21f04458

SHA1
bfa7105023d30a42b9cfbdfa3ce7e8359f96bd55

SHA256
37b054eb93b2ea45a7335824dc5bde03df5e724fffddc9c05e07f80158466889

SHA512
54078e0411b8191ffaa5f5bcff4ca6c865c69ab7feac6cda26e51d7826d36ee5f0bad2df2b1004775d914ebb1ffa603c6f87b931c8a5f5db9cfd38783ae576cf

Download Submit
memory/816-25-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/816-26-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/816-20-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/816-21-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/816-22-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/816-23-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/816-1-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/816-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/816-24-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/816-27-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/816-28-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/816-29-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/816-30-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/816-31-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/816-32-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads