3a0da8dcfc1a1d02d6a4fa69a43c48546ec97545005d2917ca32075c8d51d082

General

Target

3a0da8dcfc1a1d02d6a4fa69a43c48546ec97545005d2917ca32075c8d51d082.exe
Size

262KB
MD5

62d4dc40fba011645eba8418f7f65537
SHA1

f9d2a45f7d547eef3dd730e9b91f53ad7f7ee4f6
SHA256

3a0da8dcfc1a1d02d6a4fa69a43c48546ec97545005d2917ca32075c8d51d082
SHA512

3f425a897f87a880bd672d2e427bd82c9a5f002666b5d646aada2e5a3b0762d15edeaf8b2e004930515954e646614c04d58c0e34892e53ceffe25ca56c461d58

Score

10^/10

suricata

Malware Config

Signatures

suricata: ET MALWARE Ransomware Locky CnC Beacon 21 May
suricata: ET MALWARE Ransomware Locky CnC Beacon 21 May
suricata

Suspicious use of SetThreadContext 1 IoCs

Processes:

3a0da8dcfc1a1d02d6a4fa69a43c48546ec97545005d2917ca32075c8d51d082.exe

description	pid	process	target process
PID 4480 set thread context of 540	4480	3a0da8dcfc1a1d02d6a4fa69a43c48546ec97545005d2917ca32075c8d51d082.exe	3a0da8dcfc1a1d02d6a4fa69a43c48546ec97545005d2917ca32075c8d51d082.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

3a0da8dcfc1a1d02d6a4fa69a43c48546ec97545005d2917ca32075c8d51d082.exe

description	pid	process	target process
PID 4480 wrote to memory of 540	4480	3a0da8dcfc1a1d02d6a4fa69a43c48546ec97545005d2917ca32075c8d51d082.exe	3a0da8dcfc1a1d02d6a4fa69a43c48546ec97545005d2917ca32075c8d51d082.exe
PID 4480 wrote to memory of 540	4480	3a0da8dcfc1a1d02d6a4fa69a43c48546ec97545005d2917ca32075c8d51d082.exe	3a0da8dcfc1a1d02d6a4fa69a43c48546ec97545005d2917ca32075c8d51d082.exe
PID 4480 wrote to memory of 540	4480	3a0da8dcfc1a1d02d6a4fa69a43c48546ec97545005d2917ca32075c8d51d082.exe	3a0da8dcfc1a1d02d6a4fa69a43c48546ec97545005d2917ca32075c8d51d082.exe
PID 4480 wrote to memory of 540	4480	3a0da8dcfc1a1d02d6a4fa69a43c48546ec97545005d2917ca32075c8d51d082.exe	3a0da8dcfc1a1d02d6a4fa69a43c48546ec97545005d2917ca32075c8d51d082.exe
PID 4480 wrote to memory of 540	4480	3a0da8dcfc1a1d02d6a4fa69a43c48546ec97545005d2917ca32075c8d51d082.exe	3a0da8dcfc1a1d02d6a4fa69a43c48546ec97545005d2917ca32075c8d51d082.exe
PID 4480 wrote to memory of 540	4480	3a0da8dcfc1a1d02d6a4fa69a43c48546ec97545005d2917ca32075c8d51d082.exe	3a0da8dcfc1a1d02d6a4fa69a43c48546ec97545005d2917ca32075c8d51d082.exe
PID 4480 wrote to memory of 540	4480	3a0da8dcfc1a1d02d6a4fa69a43c48546ec97545005d2917ca32075c8d51d082.exe	3a0da8dcfc1a1d02d6a4fa69a43c48546ec97545005d2917ca32075c8d51d082.exe
PID 4480 wrote to memory of 540	4480	3a0da8dcfc1a1d02d6a4fa69a43c48546ec97545005d2917ca32075c8d51d082.exe	3a0da8dcfc1a1d02d6a4fa69a43c48546ec97545005d2917ca32075c8d51d082.exe
PID 4480 wrote to memory of 540	4480	3a0da8dcfc1a1d02d6a4fa69a43c48546ec97545005d2917ca32075c8d51d082.exe	3a0da8dcfc1a1d02d6a4fa69a43c48546ec97545005d2917ca32075c8d51d082.exe
PID 4480 wrote to memory of 540	4480	3a0da8dcfc1a1d02d6a4fa69a43c48546ec97545005d2917ca32075c8d51d082.exe	3a0da8dcfc1a1d02d6a4fa69a43c48546ec97545005d2917ca32075c8d51d082.exe

C:\Users\Admin\AppData\Local\Temp\3a0da8dcfc1a1d02d6a4fa69a43c48546ec97545005d2917ca32075c8d51d082.exe
"C:\Users\Admin\AppData\Local\Temp\3a0da8dcfc1a1d02d6a4fa69a43c48546ec97545005d2917ca32075c8d51d082.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Users\Admin\AppData\Local\Temp\3a0da8dcfc1a1d02d6a4fa69a43c48546ec97545005d2917ca32075c8d51d082.exe
  "C:\Users\Admin\AppData\Local\Temp\3a0da8dcfc1a1d02d6a4fa69a43c48546ec97545005d2917ca32075c8d51d082.exe"
  2⤵
  PID:540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/540-132-0x0000000000000000-mapping.dmp

Download
memory/540-133-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/540-136-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/540-137-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/540-138-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/540-139-0x0000000001F40000-0x0000000001F66000-memory.dmp

Filesize
152KB

Download
memory/540-140-0x0000000001F40000-0x0000000001F66000-memory.dmp

Filesize
152KB

Download
memory/4480-130-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4480-131-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4480-134-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download

Analysis

Sharing