56945b10fb83eb897a742e172bf6996566064aa1af4478f37ca6d29b11704a4f

General

Target

56945b10fb83eb897a742e172bf6996566064aa1af4478f37ca6d29b11704a4f.exe
Size

84KB
MD5

0e1652599e9aedd4acd4790d9da43614
SHA1

80b6834a0a107cf84be715e819227736e1dd56ba
SHA256

56945b10fb83eb897a742e172bf6996566064aa1af4478f37ca6d29b11704a4f
SHA512

07edeaa53df9b5e743e1988d72ba878de09b58baddc30ea90b05179596e31e7fc6cc401a2cd4dc61b04b1b114845a5e7bb2b4dc925d5b9e51c4210c287f61986

Score

10^/10

suricata upx

Malware Config

Signatures

suricata: ET MALWARE Possible Kelihos.F EXE Download Common Structure
suricata: ET MALWARE Possible Kelihos.F EXE Download Common Structure
suricata

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2020-58-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/2020-61-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/2020-62-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/2020-64-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2020-66-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/2020-67-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/2020-68-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2020-69-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2020-70-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

56945b10fb83eb897a742e172bf6996566064aa1af4478f37ca6d29b11704a4f.exe

description	pid	process	target process
PID 2012 set thread context of 2020	2012	56945b10fb83eb897a742e172bf6996566064aa1af4478f37ca6d29b11704a4f.exe	56945b10fb83eb897a742e172bf6996566064aa1af4478f37ca6d29b11704a4f.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

56945b10fb83eb897a742e172bf6996566064aa1af4478f37ca6d29b11704a4f.exe

pid process

2012 56945b10fb83eb897a742e172bf6996566064aa1af4478f37ca6d29b11704a4f.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

56945b10fb83eb897a742e172bf6996566064aa1af4478f37ca6d29b11704a4f.exe

pid	process
2012	56945b10fb83eb897a742e172bf6996566064aa1af4478f37ca6d29b11704a4f.exe
2012	56945b10fb83eb897a742e172bf6996566064aa1af4478f37ca6d29b11704a4f.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

56945b10fb83eb897a742e172bf6996566064aa1af4478f37ca6d29b11704a4f.exe

description	pid	process	target process
PID 2012 wrote to memory of 2020	2012	56945b10fb83eb897a742e172bf6996566064aa1af4478f37ca6d29b11704a4f.exe	56945b10fb83eb897a742e172bf6996566064aa1af4478f37ca6d29b11704a4f.exe
PID 2012 wrote to memory of 2020	2012	56945b10fb83eb897a742e172bf6996566064aa1af4478f37ca6d29b11704a4f.exe	56945b10fb83eb897a742e172bf6996566064aa1af4478f37ca6d29b11704a4f.exe
PID 2012 wrote to memory of 2020	2012	56945b10fb83eb897a742e172bf6996566064aa1af4478f37ca6d29b11704a4f.exe	56945b10fb83eb897a742e172bf6996566064aa1af4478f37ca6d29b11704a4f.exe
PID 2012 wrote to memory of 2020	2012	56945b10fb83eb897a742e172bf6996566064aa1af4478f37ca6d29b11704a4f.exe	56945b10fb83eb897a742e172bf6996566064aa1af4478f37ca6d29b11704a4f.exe
PID 2012 wrote to memory of 2020	2012	56945b10fb83eb897a742e172bf6996566064aa1af4478f37ca6d29b11704a4f.exe	56945b10fb83eb897a742e172bf6996566064aa1af4478f37ca6d29b11704a4f.exe
PID 2012 wrote to memory of 2020	2012	56945b10fb83eb897a742e172bf6996566064aa1af4478f37ca6d29b11704a4f.exe	56945b10fb83eb897a742e172bf6996566064aa1af4478f37ca6d29b11704a4f.exe
PID 2012 wrote to memory of 2020	2012	56945b10fb83eb897a742e172bf6996566064aa1af4478f37ca6d29b11704a4f.exe	56945b10fb83eb897a742e172bf6996566064aa1af4478f37ca6d29b11704a4f.exe
PID 2012 wrote to memory of 2020	2012	56945b10fb83eb897a742e172bf6996566064aa1af4478f37ca6d29b11704a4f.exe	56945b10fb83eb897a742e172bf6996566064aa1af4478f37ca6d29b11704a4f.exe
PID 2012 wrote to memory of 2020	2012	56945b10fb83eb897a742e172bf6996566064aa1af4478f37ca6d29b11704a4f.exe	56945b10fb83eb897a742e172bf6996566064aa1af4478f37ca6d29b11704a4f.exe

C:\Users\Admin\AppData\Local\Temp\56945b10fb83eb897a742e172bf6996566064aa1af4478f37ca6d29b11704a4f.exe
"C:\Users\Admin\AppData\Local\Temp\56945b10fb83eb897a742e172bf6996566064aa1af4478f37ca6d29b11704a4f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012

C:\Users\Admin\AppData\Local\Temp\56945b10fb83eb897a742e172bf6996566064aa1af4478f37ca6d29b11704a4f.exe
C:\Users\Admin\AppData\Local\Temp\56945b10fb83eb897a742e172bf6996566064aa1af4478f37ca6d29b11704a4f.exe
2⤵
PID:2020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2012-59-0x00000000002D0000-0x00000000002D4000-memory.dmp

Filesize
16KB

Download
memory/2012-54-0x0000000075791000-0x0000000075793000-memory.dmp

Filesize
8KB

Download
memory/2020-62-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/2020-57-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/2020-58-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/2020-61-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/2020-55-0x00000000001B0000-0x00000000002AA000-memory.dmp

Filesize
1000KB

Download
memory/2020-63-0x00000000004076A0-mapping.dmp

Download
memory/2020-64-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2020-66-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/2020-67-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/2020-68-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2020-69-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2020-70-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads