f2908e2679c5af3a366c3cbf996e6c4b24e531338053f5114d8e55a0184ba9c1

General

Target

5282245aa0136a7a55e995ef62b93e13.exe
Size

103KB
MD5

5282245aa0136a7a55e995ef62b93e13
SHA1

c9dd42a79f257f443f9495b23287a2b651206150
SHA256

f2908e2679c5af3a366c3cbf996e6c4b24e531338053f5114d8e55a0184ba9c1
SHA512

cdee16880efdb408c0df0e4539b714a7d7c384172bd97b4b00cd6793cec37ae4990e9bb6011613e164af33eafcfb654b14c9a913a012e0f75f34f3ca40d60f2c
SSDEEP

1536:3UUUUUUUUUUHdTD+vvvvvvvvvh+UUUUUUUC9mIkkkkkkTyhhhhhhhMqgCZVU4sPq:blN9RkkkkkkTLqDX3qiJ

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2168-0-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2168-1-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/files/0x003800000001484b-6.dat	upx
behavioral1/memory/2168-22-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2168-23-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2168-24-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2168-25-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2168-26-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2168-27-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2168-28-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2168-29-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2168-30-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2168-31-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2168-32-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2168-33-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2168-34-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Drops file in Windows directory 20 IoCs

description	ioc	Process
File created	C:\Windows\win32dc\UT2004(crack).exe	5282245aa0136a7a55e995ef62b93e13.exe
File opened for modification	C:\Windows\win32dc\Half-Life 2 serial.exe	5282245aa0136a7a55e995ef62b93e13.exe
File created	C:\Windows\win32dc\DAoC + crack.exe	5282245aa0136a7a55e995ef62b93e13.exe
File created	C:\Windows\win32dc\FlatOut + codes.exe	5282245aa0136a7a55e995ef62b93e13.exe
File opened for modification	C:\Windows\win32dc\Half-Life 2_cdfix.exe	5282245aa0136a7a55e995ef62b93e13.exe
File created	C:\Windows\win32dc\Counter-Strike + cheat.exe	5282245aa0136a7a55e995ef62b93e13.exe
File created	C:\Windows\win32dc\Sims 2_crack.exe	5282245aa0136a7a55e995ef62b93e13.exe
File opened for modification	C:\Windows\win32dc\UT2004 + hack.exe	5282245aa0136a7a55e995ef62b93e13.exe
File opened for modification	C:\Windows\win32dc\UT2004(crack).exe	5282245aa0136a7a55e995ef62b93e13.exe
File opened for modification	C:\Windows\win32dc\Silent Hill 4 + cdfix.exe	5282245aa0136a7a55e995ef62b93e13.exe
File created	C:\Windows\win32dc\UT2004 + hack.exe	5282245aa0136a7a55e995ef62b93e13.exe
File created	C:\Windows\win32dc\Half-Life 2 serial.exe	5282245aa0136a7a55e995ef62b93e13.exe
File opened for modification	C:\Windows\win32dc\DAoC + crack.exe	5282245aa0136a7a55e995ef62b93e13.exe
File opened for modification	C:\Windows\win32dc\FlatOut + codes.exe	5282245aa0136a7a55e995ef62b93e13.exe
File opened for modification	C:\Windows\win32dc\DAoC_cdfix.exe	5282245aa0136a7a55e995ef62b93e13.exe
File created	C:\Windows\win32dc\Silent Hill 4 + cdfix.exe	5282245aa0136a7a55e995ef62b93e13.exe
File created	C:\Windows\win32dc\DAoC_cdfix.exe	5282245aa0136a7a55e995ef62b93e13.exe
File created	C:\Windows\win32dc\Half-Life 2_cdfix.exe	5282245aa0136a7a55e995ef62b93e13.exe
File opened for modification	C:\Windows\win32dc\Counter-Strike + cheat.exe	5282245aa0136a7a55e995ef62b93e13.exe
File opened for modification	C:\Windows\win32dc\Sims 2_crack.exe	5282245aa0136a7a55e995ef62b93e13.exe

C:\Users\Admin\AppData\Local\Temp\5282245aa0136a7a55e995ef62b93e13.exe
"C:\Users\Admin\AppData\Local\Temp\5282245aa0136a7a55e995ef62b93e13.exe"
1⤵
- Drops file in Windows directory
PID:2168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win32dc\DAoC + crack.exe

Filesize
105KB

MD5
458964d112e4d4acb09be654d0f00bf0

SHA1
ceb51a881d2c4afb7d8b40a330e52451ce3556ff

SHA256
82b75fa01f8939240e1070ce3adcd58801946a72cfe319539c343f9fca2561a0

SHA512
dd6fb262962efab2549173e44b0345cdb5c2ff86cc71a16c96c83447c6f705cf1ccfa5b9eff751749ea0446b07ac47f89442e07ada6a8613cfedb7280b157e90

Download Submit
memory/2168-27-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2168-28-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2168-22-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2168-23-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2168-24-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2168-25-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2168-1-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2168-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2168-26-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2168-29-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2168-30-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2168-31-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2168-32-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2168-33-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2168-34-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads