068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce

Analysis

Target

068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce.exe
Size

114KB
MD5

9173148ca5304dd9b023744004d15657
SHA1

3bbdd49b5f79749bc99c347d69f62216e6b474de
SHA256

068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce
SHA512

00c4f73aa875b5520e9b0c36bb981be0890abd4ded4ce86a039d2951968ca37757ae39f98e7e9939b3db75a2d3803585690726033f5a827a7d4d7a06cb6434a1

Score

10^/10

suricata

suricata: ET MALWARE Generic - POST To .php w/Extended ASCII Characters
suricata: ET MALWARE Generic - POST To .php w/Extended ASCII Characters
suricata
suricata: ET MALWARE Ransomware Locky CnC Beacon 2
suricata: ET MALWARE Ransomware Locky CnC Beacon 2
suricata

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2888 set thread context of 3456	2888	068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce.exe	79

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 3456	2888	068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce.exe	79
PID 2888 wrote to memory of 3456	2888	068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce.exe	79
PID 2888 wrote to memory of 3456	2888	068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce.exe	79
PID 2888 wrote to memory of 3456	2888	068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce.exe	79
PID 2888 wrote to memory of 3456	2888	068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce.exe	79
PID 2888 wrote to memory of 3456	2888	068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce.exe	79
PID 2888 wrote to memory of 3456	2888	068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce.exe	79
PID 2888 wrote to memory of 3456	2888	068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce.exe	79
PID 2888 wrote to memory of 3456	2888	068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce.exe	79
PID 2888 wrote to memory of 3456	2888	068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce.exe	79

C:\Users\Admin\AppData\Local\Temp\068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce.exe
"C:\Users\Admin\AppData\Local\Temp\068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Users\Admin\AppData\Local\Temp\068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce.exe
  "C:\Users\Admin\AppData\Local\Temp\068c5a04584e0687bb57de1a3165f87dd9d9f4ef318eef6ef99eaa523dd7edce.exe"
  2⤵
  PID:3456

memory/3456-131-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3456-132-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3456-133-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3456-134-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3456-135-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3456-137-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3456-138-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3456-139-0x0000000001F40000-0x0000000001F61000-memory.dmp

Filesize
132KB

Download
memory/3456-140-0x0000000001F40000-0x0000000001F61000-memory.dmp

Filesize
132KB

Download