e49879acb4ea83ddefa7eb7f6e62537466628aac158eebc8beec63b7f8387fad

Analysis

max time kernel
151s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 06:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bac35f192099b04b26510be1c3cdced8.exe
Size

599KB
MD5

bac35f192099b04b26510be1c3cdced8
SHA1

5fe7614738465ba426a4cbf1862c6c50c22a5faf
SHA256

e49879acb4ea83ddefa7eb7f6e62537466628aac158eebc8beec63b7f8387fad
SHA512

bd67e20da2299f2564a7f9e8af0be24b80ae42f1781f71d71d1c517272d4436e631153640a5bd5a05e3b1caa9d873309eec340ffbfdf6661e1789175811e25a1
SSDEEP

6144:5dkkkkkkUnJIU/85o9ofFVlFb03hAdkkkkkkk0nJIU/85o9ofFVlFb03j0gBwBrA:5C65o+fnfH65o+fn8gBrBqgLeRgYMV+b

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2928-0-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/2928-1-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/files/0x0009000000023247-6.dat	upx
behavioral2/memory/2928-21-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/2928-22-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/2928-23-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/2928-24-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/2928-26-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/2928-27-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/2928-28-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/2928-29-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/2928-30-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/2928-31-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/2928-32-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/2928-33-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\win32dc\Sims 2(trainer).exe	bac35f192099b04b26510be1c3cdced8.exe
File opened for modification	C:\Windows\win32dc\Sims 2(trainer).exe	bac35f192099b04b26510be1c3cdced8.exe
File created	C:\Windows\win32dc\Quake3 + trainer.exe	bac35f192099b04b26510be1c3cdced8.exe
File created	C:\Windows\win32dc\Silent Hill 4 + serial.exe	bac35f192099b04b26510be1c3cdced8.exe
File created	C:\Windows\win32dc\Counter-Strike cdfix.exe	bac35f192099b04b26510be1c3cdced8.exe
File opened for modification	C:\Windows\win32dc\Counter-Strike cdfix.exe	bac35f192099b04b26510be1c3cdced8.exe
File created	C:\Windows\win32dc\Quake3_cdfix.exe	bac35f192099b04b26510be1c3cdced8.exe
File created	C:\Windows\win32dc\DAoC_fix.exe	bac35f192099b04b26510be1c3cdced8.exe
File opened for modification	C:\Windows\win32dc\DAoC_fix.exe	bac35f192099b04b26510be1c3cdced8.exe
File created	C:\Windows\win32dc\Silent Hill 4 cheat.exe	bac35f192099b04b26510be1c3cdced8.exe
File opened for modification	C:\Windows\win32dc\Quake3 + trainer.exe	bac35f192099b04b26510be1c3cdced8.exe
File created	C:\Windows\win32dc\BattleField 1942 + fix.exe	bac35f192099b04b26510be1c3cdced8.exe
File opened for modification	C:\Windows\win32dc\Sims 2_codes.exe	bac35f192099b04b26510be1c3cdced8.exe
File created	C:\Windows\win32dc\Half-Life 2 hack.exe	bac35f192099b04b26510be1c3cdced8.exe
File created	C:\Windows\win32dc\Sims 2_codes.exe	bac35f192099b04b26510be1c3cdced8.exe
File opened for modification	C:\Windows\win32dc\Silent Hill 4 cheat.exe	bac35f192099b04b26510be1c3cdced8.exe
File opened for modification	C:\Windows\win32dc\Silent Hill 4 + serial.exe	bac35f192099b04b26510be1c3cdced8.exe
File opened for modification	C:\Windows\win32dc\BattleField 1942 + fix.exe	bac35f192099b04b26510be1c3cdced8.exe
File opened for modification	C:\Windows\win32dc\Quake3_cdfix.exe	bac35f192099b04b26510be1c3cdced8.exe

C:\Users\Admin\AppData\Local\Temp\bac35f192099b04b26510be1c3cdced8.exe
"C:\Users\Admin\AppData\Local\Temp\bac35f192099b04b26510be1c3cdced8.exe"
1⤵
- Drops file in Windows directory
PID:2928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win32dc\Half-Life 2 hack.exe

Filesize
599KB

MD5
bac35f192099b04b26510be1c3cdced8

SHA1
5fe7614738465ba426a4cbf1862c6c50c22a5faf

SHA256
e49879acb4ea83ddefa7eb7f6e62537466628aac158eebc8beec63b7f8387fad

SHA512
bd67e20da2299f2564a7f9e8af0be24b80ae42f1781f71d71d1c517272d4436e631153640a5bd5a05e3b1caa9d873309eec340ffbfdf6661e1789175811e25a1

Download Submit
memory/2928-24-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2928-27-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2928-21-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2928-22-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2928-23-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2928-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2928-26-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2928-1-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2928-28-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2928-29-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2928-30-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2928-31-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2928-32-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2928-33-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads