7130128c5bf964cc12d98bcdbf05b4420c7e29b81ba88006040dc96ec5981aed

General

Target

1d15d41b16193d89eb52781c86f9eb4c.exe
Size

107KB
MD5

1d15d41b16193d89eb52781c86f9eb4c
SHA1

39d32c1acdc0199734741ba2a9394f34357f0152
SHA256

7130128c5bf964cc12d98bcdbf05b4420c7e29b81ba88006040dc96ec5981aed
SHA512

5fee4f0538b33f4741435bea6b16d0a3bbcd2878022ce931132120121faa7b6f82a4b8f2a6e0e39df1047019ada6d13617417be8e93511238f1c265579b7279e
SSDEEP

1536:1MRxANjduCoaYp8iJVmrsA8tx0Z8IYHPp8x5OVB80/TsrWFISJ/uxzNLC1Br5reg:1ZduCcp8iJUAAkRc5gJTjFXIx61N7

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000014667-5.dat	upx
behavioral1/memory/836-0-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/836-20-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/836-21-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/836-22-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/836-23-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/836-24-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/836-25-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/836-26-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/836-27-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/836-28-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/836-29-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/836-30-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/836-31-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/836-32-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/836-33-0x0000000000400000-0x0000000000417000-memory.dmp	upx

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win32dc\BattleField 1942(cdfix).exe	1d15d41b16193d89eb52781c86f9eb4c.exe
File created	C:\Windows\win32dc\UT2004(nocd).exe	1d15d41b16193d89eb52781c86f9eb4c.exe
File opened for modification	C:\Windows\win32dc\DAoC patch.exe	1d15d41b16193d89eb52781c86f9eb4c.exe
File opened for modification	C:\Windows\win32dc\UT2004(hack).exe	1d15d41b16193d89eb52781c86f9eb4c.exe
File created	C:\Windows\win32dc\UT2004(hack).exe	1d15d41b16193d89eb52781c86f9eb4c.exe
File created	C:\Windows\win32dc\UT2004 patch.exe	1d15d41b16193d89eb52781c86f9eb4c.exe
File created	C:\Windows\win32dc\FlatOut_crack.exe	1d15d41b16193d89eb52781c86f9eb4c.exe
File opened for modification	C:\Windows\win32dc\Counter-Strike serial.exe	1d15d41b16193d89eb52781c86f9eb4c.exe
File created	C:\Windows\win32dc\DAoC + trainer.exe	1d15d41b16193d89eb52781c86f9eb4c.exe
File created	C:\Windows\win32dc\Counter-Strike + nocd.exe	1d15d41b16193d89eb52781c86f9eb4c.exe
File created	C:\Windows\win32dc\BattleField 1942(cdfix).exe	1d15d41b16193d89eb52781c86f9eb4c.exe
File created	C:\Windows\win32dc\Counter-Strike serial.exe	1d15d41b16193d89eb52781c86f9eb4c.exe
File created	C:\Windows\win32dc\DAoC patch.exe	1d15d41b16193d89eb52781c86f9eb4c.exe
File opened for modification	C:\Windows\win32dc\DAoC + trainer.exe	1d15d41b16193d89eb52781c86f9eb4c.exe
File opened for modification	C:\Windows\win32dc\Counter-Strike + nocd.exe	1d15d41b16193d89eb52781c86f9eb4c.exe
File created	C:\Windows\win32dc\Sims 2 + hack.exe	1d15d41b16193d89eb52781c86f9eb4c.exe
File opened for modification	C:\Windows\win32dc\Sims 2 + hack.exe	1d15d41b16193d89eb52781c86f9eb4c.exe
File opened for modification	C:\Windows\win32dc\FlatOut_crack.exe	1d15d41b16193d89eb52781c86f9eb4c.exe
File opened for modification	C:\Windows\win32dc\UT2004(nocd).exe	1d15d41b16193d89eb52781c86f9eb4c.exe

C:\Users\Admin\AppData\Local\Temp\1d15d41b16193d89eb52781c86f9eb4c.exe
"C:\Users\Admin\AppData\Local\Temp\1d15d41b16193d89eb52781c86f9eb4c.exe"
1⤵
- Drops file in Windows directory
PID:836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win32dc\Sims 2 + hack.exe

Filesize
109KB

MD5
2fa8d8e496bf3c47cf4b863975508aa6

SHA1
82dc58e06a577d0a459c03a42ec761e5dff2820f

SHA256
1752e6aa6c86b579491ca586a3a6823670d40a5c7885195ad001c33220c99d90

SHA512
bf818bc35d7564c70ddcb8f49051857c6ef758ba2149dfd490a310f34ed8849eb2e85af78450238f0da692246c498099be8d2a366676e2467f6de8710f81730f

Download Submit
memory/836-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/836-20-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/836-21-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/836-22-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/836-23-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/836-24-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/836-25-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/836-26-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/836-27-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/836-28-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/836-29-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/836-30-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/836-31-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/836-32-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/836-33-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads