2a9f7947cfdde4e242a1f49e079a900c41f82b2a5f0995ece39b7a57a3796d3c

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23/01/2024, 20:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70780a5c27de2e8f67479c09259245f4.exe
Size

111KB
MD5

70780a5c27de2e8f67479c09259245f4
SHA1

cf674f0f21ffa5909e82f76ac8d813bafd37a35e
SHA256

2a9f7947cfdde4e242a1f49e079a900c41f82b2a5f0995ece39b7a57a3796d3c
SHA512

abaa8b8df9d187405e93d16ebcc8d64ccf4c2716265f2303d7b743775c962f336a5c5cf41baebca489346cb4153cc8c84b1c43844351b1e84244b5d2a665a772
SSDEEP

1536:3UUUUUUUUUUHdTD+vvvvvvvvvh+UUUUUUUC9mIkkkkkkTyhhhhhhhM60pHojwFx6:blN9RkkkkkkTL6C1SU8R+VHkj7

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1296-0-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/1296-1-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/files/0x0006000000023215-6.dat	upx
behavioral2/memory/1296-18-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/1296-19-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/1296-20-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/1296-21-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/1296-22-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/1296-23-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/1296-24-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/1296-25-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/1296-26-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/1296-27-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/1296-28-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/1296-29-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/1296-30-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\win32dc\FlatOut(cdfix).exe	70780a5c27de2e8f67479c09259245f4.exe
File created	C:\Windows\win32dc\FlatOut_trainer.exe	70780a5c27de2e8f67479c09259245f4.exe
File created	C:\Windows\win32dc\UT2004(hack).exe	70780a5c27de2e8f67479c09259245f4.exe
File opened for modification	C:\Windows\win32dc\Quake3_trainer.exe	70780a5c27de2e8f67479c09259245f4.exe
File created	C:\Windows\win32dc\UT2004_nocd.exe	70780a5c27de2e8f67479c09259245f4.exe
File opened for modification	C:\Windows\win32dc\FlatOut(cdfix).exe	70780a5c27de2e8f67479c09259245f4.exe
File opened for modification	C:\Windows\win32dc\Quake3 + nocd.exe	70780a5c27de2e8f67479c09259245f4.exe
File created	C:\Windows\win32dc\Quake3_trainer.exe	70780a5c27de2e8f67479c09259245f4.exe
File opened for modification	C:\Windows\win32dc\UT2004_nocd.exe	70780a5c27de2e8f67479c09259245f4.exe
File created	C:\Windows\win32dc\DAoC + hack.exe	70780a5c27de2e8f67479c09259245f4.exe
File created	C:\Windows\win32dc\Doom 3 nocd.exe	70780a5c27de2e8f67479c09259245f4.exe
File created	C:\Windows\win32dc\BattleField 1942(cheat).exe	70780a5c27de2e8f67479c09259245f4.exe
File opened for modification	C:\Windows\win32dc\DAoC + hack.exe	70780a5c27de2e8f67479c09259245f4.exe
File created	C:\Windows\win32dc\Quake3 + nocd.exe	70780a5c27de2e8f67479c09259245f4.exe
File created	C:\Windows\win32dc\Silent Hill 4 + cheat.exe	70780a5c27de2e8f67479c09259245f4.exe
File opened for modification	C:\Windows\win32dc\Silent Hill 4 + cheat.exe	70780a5c27de2e8f67479c09259245f4.exe

C:\Users\Admin\AppData\Local\Temp\70780a5c27de2e8f67479c09259245f4.exe
"C:\Users\Admin\AppData\Local\Temp\70780a5c27de2e8f67479c09259245f4.exe"
1⤵
- Drops file in Windows directory
PID:1296

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win32dc\Quake3 + nocd.exe

Filesize
113KB

MD5
8e8686eccd2945286eae3b2f07275885

SHA1
8e86b0e4b522d16421a9c06d5c902aa610bbee70

SHA256
2aba274bbcb5c40bd2506db7c8274ca9dc3334edfbc901b3ed498b8e75abecc8

SHA512
380369301459f83d8aea515862eef6425f47da93f4f35e0dcf27234b56c541a5656c1816d92305554e2d54ff7912a7070bb232f3eb50c5e265f69958de1b70cf

Download Submit
memory/1296-23-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1296-26-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1296-18-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1296-19-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1296-20-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1296-21-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1296-1-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1296-24-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1296-22-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1296-25-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1296-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1296-27-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1296-28-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1296-29-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1296-30-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads