3c2bdaaae53dde794bb0809ee51108a4ebfb20a316b5289f226e6e4e4475a08b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
09-03-2024 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c2bdaaae53dde794bb0809ee51108a4ebfb20a316b5289f226e6e4e4475a08b.exe
Size

299KB
MD5

af9bc886e4cb7a23dbad2b23b41b7e42
SHA1

bdf94bd4a179721cfb3cde9a2177a8b8d9732c80
SHA256

3c2bdaaae53dde794bb0809ee51108a4ebfb20a316b5289f226e6e4e4475a08b
SHA512

aa4383b0722e8b970640947c8060d19131e917ae3be9ec3ffc172cf2d1b62808325115d291c274ff6746d67b110f48befad7a926e3c2f55a1a1dd6b6293a9796
SSDEEP

6144:uuq1yy/pjnkWcLkONgMDGMHTiLCwKurwN51OeAiHTBMNevK1:y1yc9kWc4u7DGMyCN5IniHyevK1

Score

9^/10

upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral1/memory/2860-0-0x0000000000400000-0x0000000000418000-memory.dmp	UPX
behavioral1/files/0x0007000000016d16-5.dat	UPX
behavioral1/memory/2860-17-0x0000000000400000-0x0000000000418000-memory.dmp	UPX

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2860-0-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral1/files/0x0007000000016d16-5.dat	upx
behavioral1/memory/2860-17-0x0000000000400000-0x0000000000418000-memory.dmp	upx

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\win32dc\FlatOut + trainer.exe	3c2bdaaae53dde794bb0809ee51108a4ebfb20a316b5289f226e6e4e4475a08b.exe
File opened for modification	C:\Windows\win32dc\Quake3(nocd).exe	3c2bdaaae53dde794bb0809ee51108a4ebfb20a316b5289f226e6e4e4475a08b.exe
File created	C:\Windows\win32dc\Doom 3 + cheat.exe	3c2bdaaae53dde794bb0809ee51108a4ebfb20a316b5289f226e6e4e4475a08b.exe
File opened for modification	C:\Windows\win32dc\BattleField 1942_trainer.exe	3c2bdaaae53dde794bb0809ee51108a4ebfb20a316b5289f226e6e4e4475a08b.exe
File created	C:\Windows\win32dc\Silent Hill 4 + codes.exe	3c2bdaaae53dde794bb0809ee51108a4ebfb20a316b5289f226e6e4e4475a08b.exe
File opened for modification	C:\Windows\win32dc\FlatOut + trainer.exe	3c2bdaaae53dde794bb0809ee51108a4ebfb20a316b5289f226e6e4e4475a08b.exe
File created	C:\Windows\win32dc\FlatOut + cheat.exe	3c2bdaaae53dde794bb0809ee51108a4ebfb20a316b5289f226e6e4e4475a08b.exe
File created	C:\Windows\win32dc\BattleField 1942_trainer.exe	3c2bdaaae53dde794bb0809ee51108a4ebfb20a316b5289f226e6e4e4475a08b.exe
File created	C:\Windows\win32dc\Counter-Strike(nocd).exe	3c2bdaaae53dde794bb0809ee51108a4ebfb20a316b5289f226e6e4e4475a08b.exe
File created	C:\Windows\win32dc\Counter-Strike codes.exe	3c2bdaaae53dde794bb0809ee51108a4ebfb20a316b5289f226e6e4e4475a08b.exe
File created	C:\Windows\win32dc\BattleField 1942 patch.exe	3c2bdaaae53dde794bb0809ee51108a4ebfb20a316b5289f226e6e4e4475a08b.exe
File opened for modification	C:\Windows\win32dc\BattleField 1942 patch.exe	3c2bdaaae53dde794bb0809ee51108a4ebfb20a316b5289f226e6e4e4475a08b.exe
File created	C:\Windows\win32dc\Counter-Strike_fix.exe	3c2bdaaae53dde794bb0809ee51108a4ebfb20a316b5289f226e6e4e4475a08b.exe
File opened for modification	C:\Windows\win32dc\Counter-Strike_fix.exe	3c2bdaaae53dde794bb0809ee51108a4ebfb20a316b5289f226e6e4e4475a08b.exe
File created	C:\Windows\win32dc\Quake3(nocd).exe	3c2bdaaae53dde794bb0809ee51108a4ebfb20a316b5289f226e6e4e4475a08b.exe
File opened for modification	C:\Windows\win32dc\Silent Hill 4 + codes.exe	3c2bdaaae53dde794bb0809ee51108a4ebfb20a316b5289f226e6e4e4475a08b.exe

C:\Users\Admin\AppData\Local\Temp\3c2bdaaae53dde794bb0809ee51108a4ebfb20a316b5289f226e6e4e4475a08b.exe
"C:\Users\Admin\AppData\Local\Temp\3c2bdaaae53dde794bb0809ee51108a4ebfb20a316b5289f226e6e4e4475a08b.exe"
1⤵
- Drops file in Windows directory
PID:2860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win32dc\BattleField 1942 patch.exe

Filesize
301KB

MD5
403450f74287e1075b55b6eb36fe2b96

SHA1
6cef3e5ea8fb80deecf13572ec48462b98c37705

SHA256
ee8a2ca8b899c284c4688703d64fcec73602deff33e9056644d786c2b5336c44

SHA512
e72a754d8465a12347b528c960e5673e81f9a6bae46f05187c9fc153a6a4efab90712861748943935e4ce0945eee34012fff1cdaaa277e1fff3c7d74d9881198

Download Submit
memory/2860-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2860-17-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads