b1daf4cd2031776bf92e977047cf3249d85d54b5f6e6698318fa978d228f19a1

General

Target

aa66c862b01dd9fd694578a79abf8e27.exe
Size

102KB
MD5

aa66c862b01dd9fd694578a79abf8e27
SHA1

463f364243458eaf8da11da0d1c9d4888ad712c0
SHA256

b1daf4cd2031776bf92e977047cf3249d85d54b5f6e6698318fa978d228f19a1
SHA512

2b931e8db96f1d015f0c9ce8c38f810655798fd3a0502b93e91cd46de99fa47b5938160ba36d2c366781cdd27b475718337fb00fed0720a9e646dd9b0e88b674
SSDEEP

1536:3UUUUUUUUUUHdTD+vvvvvvvvvh+UUUUUUUC9mIkkkkkkTyhhhhhhhM984DPh6DMa:blN9RkkkkkkTL984DPh6DM/nlE

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2008-0-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2008-1-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/files/0x00070000000155ef-6.dat	upx
behavioral1/memory/2008-17-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2008-18-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2008-19-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2008-20-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2008-21-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2008-22-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2008-23-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2008-24-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2008-25-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2008-26-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2008-27-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2008-28-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2008-29-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2008-30-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\win32dc\Silent Hill 4(serial).exe	aa66c862b01dd9fd694578a79abf8e27.exe
File created	C:\Windows\win32dc\FlatOut(hack).exe	aa66c862b01dd9fd694578a79abf8e27.exe
File opened for modification	C:\Windows\win32dc\FlatOut(hack).exe	aa66c862b01dd9fd694578a79abf8e27.exe
File created	C:\Windows\win32dc\Quake3 + codes.exe	aa66c862b01dd9fd694578a79abf8e27.exe
File opened for modification	C:\Windows\win32dc\Quake3 + codes.exe	aa66c862b01dd9fd694578a79abf8e27.exe
File created	C:\Windows\win32dc\Counter-Strike patch.exe	aa66c862b01dd9fd694578a79abf8e27.exe
File created	C:\Windows\win32dc\Quake3 + crack.exe	aa66c862b01dd9fd694578a79abf8e27.exe
File created	C:\Windows\win32dc\Half-Life 2_hack.exe	aa66c862b01dd9fd694578a79abf8e27.exe
File created	C:\Windows\win32dc\BattleField 1942(fix).exe	aa66c862b01dd9fd694578a79abf8e27.exe
File created	C:\Windows\win32dc\Counter-Strike trainer.exe	aa66c862b01dd9fd694578a79abf8e27.exe
File opened for modification	C:\Windows\win32dc\FlatOut + codes.exe	aa66c862b01dd9fd694578a79abf8e27.exe
File created	C:\Windows\win32dc\Counter-Strike + serial.exe	aa66c862b01dd9fd694578a79abf8e27.exe
File created	C:\Windows\win32dc\FlatOut + codes.exe	aa66c862b01dd9fd694578a79abf8e27.exe
File opened for modification	C:\Windows\win32dc\Half-Life 2_hack.exe	aa66c862b01dd9fd694578a79abf8e27.exe
File opened for modification	C:\Windows\win32dc\Counter-Strike + serial.exe	aa66c862b01dd9fd694578a79abf8e27.exe

C:\Users\Admin\AppData\Local\Temp\aa66c862b01dd9fd694578a79abf8e27.exe
"C:\Users\Admin\AppData\Local\Temp\aa66c862b01dd9fd694578a79abf8e27.exe"
1⤵
- Drops file in Windows directory
PID:2008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win32dc\FlatOut(hack).exe

Filesize
104KB

MD5
9017444fd8ee4ca549585f5c161b44e4

SHA1
e4ef048c543327686c483e31cff36ce71439a079

SHA256
47a63a0481bc84b09f6e559f9827659e81bed4fe5fc3c9e68e4a1136b537135b

SHA512
062b56a5174c28364e98ef72390b0064160f01fdc31a751fddb48db4b554c22b7e42b55aee2709974efd3815931ec690b6eea56d469441c0b7fa8a5d35eda6cd

Download Submit
memory/2008-22-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2008-21-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2008-17-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2008-18-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2008-23-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2008-20-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2008-1-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2008-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2008-19-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2008-24-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2008-25-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2008-26-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2008-27-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2008-28-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2008-29-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2008-30-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads