MALICIOUS — Quake3(cheat).exe

MALICIOUS — Quake3(cheat).exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Upantix family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 7fcae5e73ab457c0b48b9a15ed631cb22df6dc68485eba8cb0b181ea7f9faa6d
SHA-1: b8d35b0fc29303e54c6bb5c6c0f087128ad476a9
MD5: d68d13ae84a3201fc17c382ed0ede552
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 1536:3UUUUUUUUUUHdTD+vvvvvvvvvh+UUUUUUUC9mIkkkkkkTyhhhhhhhMSTZM+9m2OJ:blN9RkkkkkkTLSBvzq
TLSH: T1113AD040357A389CD7349F611524598DA12152C28A3D3DDA9B030B2D2D7B8FBB8E8F76
Submitted as: Quake3(cheat).exe
File type: pe · Size: 101484 bytes
Verdict: malicious (99/100) · Family: Upantix

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Trojan.Generic-9908425-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-9908425-0 (rule Win.Trojan.Generic-9908425-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (HUILoader): Sims 2 codes.exe - dynamic signal, weight 0.62, confidence 0.90
Memory forensics: 4 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 1100) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Contacted 24 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

202 behavior events · 0 ATT&CK techniques · 7 dropped files.

Dropped files

C:\Windows\win32dc\Sims 2 codes.exe - ac263e3d81f9e57aef0ca1cd240ab99d828c3194f41542dd3edcd0e2cd450079
C:\Windows\win32dc\FlatOut_fix.exe - 4855d5f494b39f0cb0deb87d682790d4b13054c841f66640e400bf72bc9e1e88
C:\Windows\win32dc\Quake3_fix.exe - b5bdd30b23e94659318d0d21b6244ac1879af26039437e43f68c92bae8539ffe
C:\Windows\win32dc\Silent Hill 4 cheat.exe - cdc877f785eafc6f720535e6492a1336d0c6583d312a3694f2b1d4ca2fd14fb8
C:\Windows\win32dc\Sims 2 patch.exe - 963400891255292ac14d1d4daf8a70428ea9390cb2a3018a5112ccbccef9652a
C:\Windows\win32dc\Silent Hill 4 trainer.exe - 17a62e31f82f98cb5369353fa09d11cf54a1a0cf3e8d2384c5b207343a98c4fb
C:\Windows\win32dc\DAoC + cheat.exe - bb429ec0f56e4404e531c611cc93165e14d70225af84d9b674936ac2b20af3fa

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787637314&P2=404&P3=2&P4=KVWRorpSx3FNPpfZLeE4T6t4gvFFLm%2bg4K1LhZPfE%2bVpOE9eT%2fdOgrJGucOMFT%2fsmTL0q%2bIbqMCiHzy2QYISgQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/45cd9142-6feb-4946-89e7-63e58fada30a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/45cd9142-6feb-4946-89e7-63e58fada30a?P1=1787637412&P2=404&P3=2&P4=jLBoLaetWaaZ664KB%2bVW6RoJsDGspRIxwvw96dKXM5oRak6nGYKjLhvbMpJgByRkbeuZdlwBh%2b6CSQ1A65aQCg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

52.123.252.244
13.89.179.15
74.179.71.159
20.42.179.204
4.230.171.124
85.210.193.152
20.247.184.197
135.233.95.144
135.232.92.97
52.168.117.168
20.76.201.171
52.123.128.14
162.159.142.9
40.104.4.2
51.104.15.253
203.26.79.13
135.233.45.222
52.123.252.242
74.178.232.29
52.148.114.188
4.150.223.115
72.154.7.99
52.110.12.15
52.110.12.48

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report