Analysis
-
max time kernel
1800s -
max time network
1594s -
platform
windows10-1703_x64 -
resource
win10-20240214-en -
resource tags
-
submitted
24/02/2024, 08:03
General
-
Target
CS1.6_NextClient_resursecs16ro_v2.3.2.exe
-
Size
247.5MB
-
MD5
b7780091ced26cb88bd271a1c3411eae
-
SHA1
fcec5e81fd3ae5cd99f2bafae937647410e26ad8
-
SHA256
4ded255e332b6d3eb2aa0330e3363b49ca9208c55fb57c310499b5a78783e3f0
-
SHA512
886760201e425575d3baeb3a1ba62843bbaca56c7dd38550d8ecaeb97c5ffb03af1fb38068a8160382208035688f21a4023df1e53185eec2a6c6f9be615ca6fd
-
SSDEEP
6291456:lo3+L6FaK214isYEZjmnrVDYIHx+JzGdqRjiLCckI8i:lo3+uFaK21T5nr5p86qVcRF
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 5 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CS1.6_NextClient_resursecs16ro_v2.3.2.exe"C:\Users\Admin\AppData\Local\Temp\CS1.6_NextClient_resursecs16ro_v2.3.2.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-28F8B.tmp\CS1.6_NextClient_resursecs16ro_v2.3.2.tmp"C:\Users\Admin\AppData\Local\Temp\is-28F8B.tmp\CS1.6_NextClient_resursecs16ro_v2.3.2.tmp" /SL5="$300DE,258527659,783872,C:\Users\Admin\AppData\Local\Temp\CS1.6_NextClient_resursecs16ro_v2.3.2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD51caa72a22046894675ecc90580a9995c
SHA1bec86e697ef79ce267ae852338d9f5667ca906a4
SHA256a0f121b1273754061d134e68399cecd48fcff085bb135b0f666927e9d820ed0e
SHA5123627c6adb955a5148bb80d59f12ad6ae453a806a01b4920734050c0e7f93ba7f1b8a678e2749d87b371e994036bad97c4329b46621039e2b9664b1a15667089b
-
Filesize
10KB
MD5841ed556044bda914a5b32cd7b0f6b52
SHA1a6a9864530abadcb70631e00613173dcd2daf1c8
SHA2568084cf13740debcea08ec69e5d396b9927844b0cbd1ebd074d7a4cdec09103bb
SHA512438a33d90480fdcf1cb757529927b7601f4304e5406cfb995f3ded550e784e9751eefb3069bd891aa3c28a38a8e4798054797f43a72e619cacc8cc77317496ba
-
Filesize
385KB
MD57d9087c4e2f9ab2db78a46ab52a7f360
SHA115624c6e5ae4b2689a6975a8faf9f0efbd940b7d
SHA256ff1374abd93690f5e6e591bae23b49aacc8bbe8b7b05b539ec8aee755070a0e3
SHA51270375fe15072531de481a0ff95473fa152178d2fd5f0610712cd4fd63ed9da9a40c669442021c23937465ee1e81c39e38332444f10463b5a4fda2048ec4f1d5a
-
Filesize
34KB
MD509974eaff6defadde38b1328754dbe09
SHA1001cfb5514444188e455b97acc369f037079ca9d
SHA2569eeef28d82fc4db7d1269dfbc0ea282768ce5e2e4e4bdc867d80d6847468dca7
SHA512da29b01ebebb454c004420c6b29bb8dca9fb50554a7a5db30035a5ec458d766049bf5502f708bf7eb210a4f9cbdb308cc0c8dcdad9f745b01a9e4f1455bbc846
-
Filesize
413KB
MD56f6c35b7edf1d7f6fde264a828cc17df
SHA16a613d881a995801ad156d0f0901c2fa617e1d70
SHA256bd371be89f5997694a224e8ff7121f0f6aa8893f31ab5bee7b6a3c32fb31d96a
SHA512ce42315cce4d64d1fb8d5897b722c275ab46f36af93c3ca7db898cf508096c525f70d38ac2181960818dfe8b323d6ccd4a55d47f65eb0f8955a2b133ec2e3b5d
-
Filesize
388KB
-
Filesize
480KB
-
Filesize
388KB
-
Filesize
476KB
-
Filesize
1.2MB
-
Filesize
476KB
-
Filesize
388KB
-
Filesize
476KB
-
Filesize
148KB
-
Filesize
388KB
-
Filesize
148KB
-
Filesize
476KB
-
Filesize
388KB
-
Filesize
184KB
-
Filesize
388KB
-
Filesize
148KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
956KB
-
Filesize
19.3MB
-
Filesize
964KB
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
388KB
-
Filesize
956KB
-
Filesize
1.3MB
-
Filesize
276KB
-
Filesize
19.3MB
-
Filesize
964KB
-
Filesize
2.1MB
-
Filesize
480KB
-
Filesize
4KB
-
Filesize
388KB
-
Filesize
476KB
-
Filesize
480KB
-
Filesize
956KB
-
Filesize
1.2MB
-
Filesize
388KB
-
Filesize
2.1MB
-
Filesize
956KB
-
Filesize
19.3MB
-
Filesize
2.1MB
-
Filesize
148KB
-
Filesize
480KB
-
Filesize
388KB
-
Filesize
956KB
-
Filesize
1.2MB
-
Filesize
19.3MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
388KB
-
Filesize
480KB
-
Filesize
956KB
-
Filesize
1.3MB
-
Filesize
276KB
-
Filesize
19.3MB
-
Filesize
964KB
-
Filesize
19.3MB
-
Filesize
140KB
-
Filesize
1.2MB
-
Filesize
388KB
-
Filesize
2.1MB
-
Filesize
19.3MB
-
Filesize
196KB
-
Filesize
4KB
-
Filesize
196KB
-
Filesize
820KB
-
Filesize
820KB
