ae314c6f487c3855074d266ad6735148cde8b7dfd9a2815077821cb731da236d

General

Target

674ee6266375648ef3dbed68402ad21f.exe
Size

122KB
MD5

674ee6266375648ef3dbed68402ad21f
SHA1

5c22afbd6d512391378bd13c62eadcdbf1ac3e72
SHA256

ae314c6f487c3855074d266ad6735148cde8b7dfd9a2815077821cb731da236d
SHA512

d0f1934310081c66c587d0ebbd5924d4476af18e7231f8962cfa8c0cb6a17b3ba5b538d80860f0edeec26a5a2f979ccf5772951c30e7bb96a19ae39e3b7309fe
SSDEEP

3072:blN9RkkkkkkTLJ0YufKOpHuMSIzNLSf1g:5dkkkkkkZpOpHRSwNsg

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2220-0-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2220-1-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/files/0x00090000000160f5-6.dat	upx
behavioral1/memory/2220-17-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2220-18-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2220-19-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2220-20-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2220-21-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2220-22-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2220-23-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2220-24-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2220-25-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2220-26-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2220-27-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2220-28-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2220-29-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win32dc\Quake3(cheat).exe	674ee6266375648ef3dbed68402ad21f.exe
File opened for modification	C:\Windows\win32dc\UT2004(serial).exe	674ee6266375648ef3dbed68402ad21f.exe
File created	C:\Windows\win32dc\BattleField 1942(patch).exe	674ee6266375648ef3dbed68402ad21f.exe
File opened for modification	C:\Windows\win32dc\Half-Life 2 serial.exe	674ee6266375648ef3dbed68402ad21f.exe
File opened for modification	C:\Windows\win32dc\FlatOut_crack.exe	674ee6266375648ef3dbed68402ad21f.exe
File created	C:\Windows\win32dc\Quake3(cheat).exe	674ee6266375648ef3dbed68402ad21f.exe
File created	C:\Windows\win32dc\Half-Life 2 nocd.exe	674ee6266375648ef3dbed68402ad21f.exe
File created	C:\Windows\win32dc\FlatOut_crack.exe	674ee6266375648ef3dbed68402ad21f.exe
File created	C:\Windows\win32dc\Silent Hill 4 + trainer.exe	674ee6266375648ef3dbed68402ad21f.exe
File opened for modification	C:\Windows\win32dc\Half-Life 2 nocd.exe	674ee6266375648ef3dbed68402ad21f.exe
File created	C:\Windows\win32dc\Half-Life 2 serial.exe	674ee6266375648ef3dbed68402ad21f.exe
File created	C:\Windows\win32dc\UT2004_serial.exe	674ee6266375648ef3dbed68402ad21f.exe
File created	C:\Windows\win32dc\DAoC + hack.exe	674ee6266375648ef3dbed68402ad21f.exe
File created	C:\Windows\win32dc\UT2004 + cdfix.exe	674ee6266375648ef3dbed68402ad21f.exe
File created	C:\Windows\win32dc\UT2004(serial).exe	674ee6266375648ef3dbed68402ad21f.exe

C:\Users\Admin\AppData\Local\Temp\674ee6266375648ef3dbed68402ad21f.exe
"C:\Users\Admin\AppData\Local\Temp\674ee6266375648ef3dbed68402ad21f.exe"
1⤵
- Drops file in Windows directory
PID:2220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win32dc\Quake3(cheat).exe

Filesize
122KB

MD5
eec1d11de9e9bd8904681315e156ffb9

SHA1
5584882bc6d623bb3cf99a436f02b11dfbadf76e

SHA256
a40a3658b3177448bacd27f78733652e45bb9935204a87022ae39f6377c5f5ee

SHA512
e00ab25ab7030bf628b08ae2e037be69690bba83c3a44312d3716cef9f4458671010f8cfe67ce090e852423f88b1ff209ba749d32e1c70c87c11a5b8f93e207e

Download Submit
memory/2220-22-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2220-23-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2220-17-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2220-18-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2220-19-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2220-20-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2220-1-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2220-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2220-21-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2220-24-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2220-25-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2220-26-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2220-27-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2220-28-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2220-29-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads