4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28

General

Target

4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe
Size

119KB
MD5

42221a3c2ef7c0b9f5292ee5f6382fc7
SHA1

6621ab1500e25cc20601754f584e8197d493840a
SHA256

4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28
SHA512

1a970195f546cb9310c8bdaee7f1cadd12ebbbd7ef84fad0ed60000c36b8e198e230bcf244a7b2962408d70438c2e8064f4bdca9bedcfdb7dbb4e2bbc8be776e

Score

10^/10

suricata

Malware Config

Signatures

suricata: ET MALWARE Generic - POST To .php w/Extended ASCII Characters
suricata: ET MALWARE Generic - POST To .php w/Extended ASCII Characters
suricata
suricata: ET MALWARE Ransomware Locky CnC Beacon 2
suricata: ET MALWARE Ransomware Locky CnC Beacon 2
suricata
suricata: ET MALWARE Win32/Necurs Common POST Header Structure
suricata: ET MALWARE Win32/Necurs Common POST Header Structure
suricata

Suspicious use of SetThreadContext 1 IoCs

Processes:

4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe

description	pid	process	target process
PID 1548 set thread context of 308	1548	4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe	4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe

description	pid	process	target process
PID 1548 wrote to memory of 308	1548	4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe	4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe
PID 1548 wrote to memory of 308	1548	4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe	4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe
PID 1548 wrote to memory of 308	1548	4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe	4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe
PID 1548 wrote to memory of 308	1548	4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe	4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe
PID 1548 wrote to memory of 308	1548	4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe	4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe
PID 1548 wrote to memory of 308	1548	4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe	4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe
PID 1548 wrote to memory of 308	1548	4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe	4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe
PID 1548 wrote to memory of 308	1548	4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe	4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe
PID 1548 wrote to memory of 308	1548	4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe	4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe

C:\Users\Admin\AppData\Local\Temp\4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe
"C:\Users\Admin\AppData\Local\Temp\4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1548

C:\Users\Admin\AppData\Local\Temp\4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe
"C:\Users\Admin\AppData\Local\Temp\4bc79bf2d2c328fc1a94b235884db6a27f5b0b9ed2e511ecec59ac573f38ed28.exe"
2⤵
PID:308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/308-54-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/308-55-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/308-59-0x00000000759E1000-0x00000000759E3000-memory.dmp

Filesize
8KB

Download
memory/308-60-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/308-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/308-64-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing