da9f6cf212e2f033d40e4546b1612d3866e61af5c938db282795ac2e5b5b813a

General

Target

da9f6cf212e2f033d40e4546b1612d3866e61af5c938db282795ac2e5b5b813a.exe
Size

96KB
MD5

7cc02fd0fa2aae34057c343f4ee8dc93
SHA1

4a88047474e6f85290fc06c1ad5d941d70481b58
SHA256

da9f6cf212e2f033d40e4546b1612d3866e61af5c938db282795ac2e5b5b813a
SHA512

b822cc0bd66a41c99fa599d1706dc27c847288e6b797a5b4ef275d360c55cef1e660eec7b254b2e995ef94a9ba7a661bfe107cdc77fa36ab807212fca8757dcc
SSDEEP

3072:n/Fkx6xV5JJRetwPW28x/b4gFcghWP58W8bjqeUY:/F5VqtqWljvFcgkcCY

Score

9^/10

aspackv2

Malware Config

Signatures

Detects executables packed with ASPack 17 IoCs

Processes:

resource	yara_rule
behavioral2/memory/368-0-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/368-1-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_EXE_Packed_ASPack
C:\Windows\win32dc\DAoC trainer.exe	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/368-18-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/368-19-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/368-20-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/368-21-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/368-22-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/368-23-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/368-24-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/368-25-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/368-26-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/368-27-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/368-28-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/368-29-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/368-30-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/368-31-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Windows\win32dc\DAoC trainer.exe	aspack_v212_v242

Drops file in Windows directory 17 IoCs

Processes:

da9f6cf212e2f033d40e4546b1612d3866e61af5c938db282795ac2e5b5b813a.exe

description	ioc	process
File opened for modification	C:\Windows\win32dc\DAoC + crack.exe	da9f6cf212e2f033d40e4546b1612d3866e61af5c938db282795ac2e5b5b813a.exe
File opened for modification	C:\Windows\win32dc\Half-Life 2 + trainer.exe	da9f6cf212e2f033d40e4546b1612d3866e61af5c938db282795ac2e5b5b813a.exe
File created	C:\Windows\win32dc\BattleField 1942 + patch.exe	da9f6cf212e2f033d40e4546b1612d3866e61af5c938db282795ac2e5b5b813a.exe
File created	C:\Windows\win32dc\BattleField 1942 hack.exe	da9f6cf212e2f033d40e4546b1612d3866e61af5c938db282795ac2e5b5b813a.exe
File created	C:\Windows\win32dc\Half-Life 2 + patch.exe	da9f6cf212e2f033d40e4546b1612d3866e61af5c938db282795ac2e5b5b813a.exe
File created	C:\Windows\win32dc\Quake3 cdfix.exe	da9f6cf212e2f033d40e4546b1612d3866e61af5c938db282795ac2e5b5b813a.exe
File opened for modification	C:\Windows\win32dc\Quake3 cdfix.exe	da9f6cf212e2f033d40e4546b1612d3866e61af5c938db282795ac2e5b5b813a.exe
File created	C:\Windows\win32dc\Half-Life 2_hack.exe	da9f6cf212e2f033d40e4546b1612d3866e61af5c938db282795ac2e5b5b813a.exe
File opened for modification	C:\Windows\win32dc\Counter-Strike + fix.exe	da9f6cf212e2f033d40e4546b1612d3866e61af5c938db282795ac2e5b5b813a.exe
File created	C:\Windows\win32dc\FlatOut_crack.exe	da9f6cf212e2f033d40e4546b1612d3866e61af5c938db282795ac2e5b5b813a.exe
File opened for modification	C:\Windows\win32dc\BattleField 1942 + patch.exe	da9f6cf212e2f033d40e4546b1612d3866e61af5c938db282795ac2e5b5b813a.exe
File created	C:\Windows\win32dc\DAoC + crack.exe	da9f6cf212e2f033d40e4546b1612d3866e61af5c938db282795ac2e5b5b813a.exe
File created	C:\Windows\win32dc\DAoC trainer.exe	da9f6cf212e2f033d40e4546b1612d3866e61af5c938db282795ac2e5b5b813a.exe
File created	C:\Windows\win32dc\Counter-Strike + fix.exe	da9f6cf212e2f033d40e4546b1612d3866e61af5c938db282795ac2e5b5b813a.exe
File created	C:\Windows\win32dc\Half-Life 2 + trainer.exe	da9f6cf212e2f033d40e4546b1612d3866e61af5c938db282795ac2e5b5b813a.exe
File opened for modification	C:\Windows\win32dc\Half-Life 2 + patch.exe	da9f6cf212e2f033d40e4546b1612d3866e61af5c938db282795ac2e5b5b813a.exe
File opened for modification	C:\Windows\win32dc\BattleField 1942 hack.exe	da9f6cf212e2f033d40e4546b1612d3866e61af5c938db282795ac2e5b5b813a.exe

C:\Users\Admin\AppData\Local\Temp\da9f6cf212e2f033d40e4546b1612d3866e61af5c938db282795ac2e5b5b813a.exe
"C:\Users\Admin\AppData\Local\Temp\da9f6cf212e2f033d40e4546b1612d3866e61af5c938db282795ac2e5b5b813a.exe"
1⤵
- Drops file in Windows directory
PID:368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win32dc\DAoC trainer.exe
Filesize
96KB

MD5
7cc02fd0fa2aae34057c343f4ee8dc93

SHA1
4a88047474e6f85290fc06c1ad5d941d70481b58

SHA256
da9f6cf212e2f033d40e4546b1612d3866e61af5c938db282795ac2e5b5b813a

SHA512
b822cc0bd66a41c99fa599d1706dc27c847288e6b797a5b4ef275d360c55cef1e660eec7b254b2e995ef94a9ba7a661bfe107cdc77fa36ab807212fca8757dcc

Download Submit
memory/368-23-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/368-22-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/368-18-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/368-19-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/368-24-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/368-21-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/368-1-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/368-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/368-20-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/368-25-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/368-26-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/368-27-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/368-28-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/368-29-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/368-30-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/368-31-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads