2559cee91008cc11beb5b42d04dc61a18ab2bb071323f93c795e22025ae7418e

General

Target

9b14c219bc2bfa6018cb44207bdb7e87.exe
Size

92KB
MD5

9b14c219bc2bfa6018cb44207bdb7e87
SHA1

a352212979b6c617f3d8e2fc8dbda3e7e24f120b
SHA256

2559cee91008cc11beb5b42d04dc61a18ab2bb071323f93c795e22025ae7418e
SHA512

f4dd8b0a151cea9ba67ac3dcffdf0c5760589abdf3398bab9dc5cfac3ea26d2a66b2fcbe256e511877d14a6fe60f89a1eceb46226b0bf1d9c2ac5fdcc5f61252
SSDEEP

1536:3UUUUUUUUUUHdTD+vvvvvvvvvh+UUUUUUUC9mIkkkkkkTyhhhhhhhMBUpiT6J:blN9RkkkkkkTLBUpiTI

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2532-0-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2532-1-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/files/0x000b000000014131-6.dat	upx
behavioral1/memory/2532-19-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2532-20-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2532-22-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2532-23-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2532-24-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2532-25-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2532-26-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2532-28-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2532-29-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2532-30-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2532-31-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2532-32-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2532-33-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win32dc\Quake3 nocd.exe	9b14c219bc2bfa6018cb44207bdb7e87.exe
File created	C:\Windows\win32dc\DAoC(patch).exe	9b14c219bc2bfa6018cb44207bdb7e87.exe
File opened for modification	C:\Windows\win32dc\Silent Hill 4 crack.exe	9b14c219bc2bfa6018cb44207bdb7e87.exe
File opened for modification	C:\Windows\win32dc\UT2004 nocd.exe	9b14c219bc2bfa6018cb44207bdb7e87.exe
File created	C:\Windows\win32dc\Doom 3_cdfix.exe	9b14c219bc2bfa6018cb44207bdb7e87.exe
File created	C:\Windows\win32dc\BattleField 1942 nocd.exe	9b14c219bc2bfa6018cb44207bdb7e87.exe
File opened for modification	C:\Windows\win32dc\BattleField 1942 nocd.exe	9b14c219bc2bfa6018cb44207bdb7e87.exe
File opened for modification	C:\Windows\win32dc\UT2004 + trainer.exe	9b14c219bc2bfa6018cb44207bdb7e87.exe
File opened for modification	C:\Windows\win32dc\DAoC(patch).exe	9b14c219bc2bfa6018cb44207bdb7e87.exe
File created	C:\Windows\win32dc\Silent Hill 4 crack.exe	9b14c219bc2bfa6018cb44207bdb7e87.exe
File created	C:\Windows\win32dc\Quake3 nocd.exe	9b14c219bc2bfa6018cb44207bdb7e87.exe
File created	C:\Windows\win32dc\UT2004 nocd.exe	9b14c219bc2bfa6018cb44207bdb7e87.exe
File created	C:\Windows\win32dc\Quake3 trainer.exe	9b14c219bc2bfa6018cb44207bdb7e87.exe
File opened for modification	C:\Windows\win32dc\Quake3 trainer.exe	9b14c219bc2bfa6018cb44207bdb7e87.exe
File created	C:\Windows\win32dc\Silent Hill 4 trainer.exe	9b14c219bc2bfa6018cb44207bdb7e87.exe
File created	C:\Windows\win32dc\UT2004 + trainer.exe	9b14c219bc2bfa6018cb44207bdb7e87.exe

C:\Users\Admin\AppData\Local\Temp\9b14c219bc2bfa6018cb44207bdb7e87.exe
"C:\Users\Admin\AppData\Local\Temp\9b14c219bc2bfa6018cb44207bdb7e87.exe"
1⤵
- Drops file in Windows directory
PID:2532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win32dc\Silent Hill 4 crack.exe

Filesize
92KB

MD5
ab36ddd2228260194ac1ceb91216e3c4

SHA1
8d44ecf090b7fb031abfc63bb85326dd834555c9

SHA256
8c0ed2e4d1f619d3ef1db0629dc26b32dd65552e7ee4e87ab68365695f27282e

SHA512
2e95dc534781ae9821e8c5a84f33d461f2594f5da5a1c8eb98573ffb90e6f0d764f686c2b33450a71dbc1c9f860a654565579e2a6547cc1dc17bf8a290ea567f

Download Submit
memory/2532-25-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2532-29-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2532-19-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2532-20-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2532-22-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2532-23-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2532-1-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2532-26-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2532-24-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2532-28-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2532-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2532-30-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2532-31-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2532-32-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2532-33-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads