b3869dcce8b59af46a5dcd2f3df9454722fcb68e4f429ab508cbde2d47ca7587

General

Target

8627b69e2d294c58f9d244663d1f865d.exe
Size

231KB
MD5

8627b69e2d294c58f9d244663d1f865d
SHA1

005c0164821c9b62c189477bbd92031e10931771
SHA256

b3869dcce8b59af46a5dcd2f3df9454722fcb68e4f429ab508cbde2d47ca7587
SHA512

bdbabc9f9df3cdffbe4031d536031ec20354a7d4a9acc1a8a5d0f3bdc9027382fd7df053e9f576be875acc168aa0d845c24a0e7ef03bc482c6b2544d67c8d282
SSDEEP

3072:blN9RkkkkkkTLJ0Y6LFKab6lN9RkkkkkkTLJ0Y6LFElZNv:5dkkkkkkZ6ZXAdkkkkkkZ6ZEfNv

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2516-0-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2516-1-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/files/0x0035000000014a9f-6.dat	upx
behavioral1/memory/2516-21-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2516-22-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2516-23-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2516-24-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2516-25-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2516-26-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2516-27-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2516-28-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2516-29-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2516-30-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2516-31-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2516-33-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2516-34-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Drops file in Windows directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win32dc\Doom 3(trainer).exe	8627b69e2d294c58f9d244663d1f865d.exe
File created	C:\Windows\win32dc\DAoC nocd.exe	8627b69e2d294c58f9d244663d1f865d.exe
File opened for modification	C:\Windows\win32dc\Sims 2 + patch.exe	8627b69e2d294c58f9d244663d1f865d.exe
File opened for modification	C:\Windows\win32dc\Half-Life 2(codes).exe	8627b69e2d294c58f9d244663d1f865d.exe
File opened for modification	C:\Windows\win32dc\Quake3 + trainer.exe	8627b69e2d294c58f9d244663d1f865d.exe
File opened for modification	C:\Windows\win32dc\DAoC nocd.exe	8627b69e2d294c58f9d244663d1f865d.exe
File opened for modification	C:\Windows\win32dc\Half-Life 2 fix.exe	8627b69e2d294c58f9d244663d1f865d.exe
File opened for modification	C:\Windows\win32dc\UT2004 codes.exe	8627b69e2d294c58f9d244663d1f865d.exe
File created	C:\Windows\win32dc\Half-Life 2(codes).exe	8627b69e2d294c58f9d244663d1f865d.exe
File opened for modification	C:\Windows\win32dc\Sims 2 + crack.exe	8627b69e2d294c58f9d244663d1f865d.exe
File created	C:\Windows\win32dc\UT2004 codes.exe	8627b69e2d294c58f9d244663d1f865d.exe
File created	C:\Windows\win32dc\Doom 3(trainer).exe	8627b69e2d294c58f9d244663d1f865d.exe
File created	C:\Windows\win32dc\Sims 2 + crack.exe	8627b69e2d294c58f9d244663d1f865d.exe
File created	C:\Windows\win32dc\Sims 2 + patch.exe	8627b69e2d294c58f9d244663d1f865d.exe
File created	C:\Windows\win32dc\Half-Life 2(fix).exe	8627b69e2d294c58f9d244663d1f865d.exe
File opened for modification	C:\Windows\win32dc\Half-Life 2(fix).exe	8627b69e2d294c58f9d244663d1f865d.exe
File created	C:\Windows\win32dc\Half-Life 2 fix.exe	8627b69e2d294c58f9d244663d1f865d.exe
File created	C:\Windows\win32dc\Quake3 + trainer.exe	8627b69e2d294c58f9d244663d1f865d.exe

C:\Users\Admin\AppData\Local\Temp\8627b69e2d294c58f9d244663d1f865d.exe
"C:\Users\Admin\AppData\Local\Temp\8627b69e2d294c58f9d244663d1f865d.exe"
1⤵
- Drops file in Windows directory
PID:2516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win32dc\Sims 2 + crack.exe

Filesize
231KB

MD5
6c8577dec3899a5190c409af6e9c56f0

SHA1
4560e7d742afa338efda2f6c6bebb002c57e8a70

SHA256
ce9823ff5465251f577f6b41f7e34d5b9291ccd7aa35e55c6aa3817f4fcdc062

SHA512
5eff0a7d45144588858f50fab0a7649caa28b98e45b16aede2c2e33ae44d00acf5773e24235efd037af4bccd24e395a182f41a5556727e49ebed765d9880ef74

Download Submit
memory/2516-26-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2516-29-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2516-21-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2516-22-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2516-23-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2516-24-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2516-1-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2516-27-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2516-25-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2516-28-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2516-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2516-30-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2516-31-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2516-33-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2516-34-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads