56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099

General

Target

56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe
Size

72KB
MD5

3f7ad33f4d00b444ac42dbaa58d8c2ee
SHA1

2c1e653d7e3f026f3801bcef183981dac1db8393
SHA256

56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099
SHA512

c292fc18f6be09ba3c24028a3726d99d8f57a9592a2a6d4dd80f03a18e2ae5d16da099cd88c132921cee9594371e8cf853a955566b245a7f38ff15593ab5a924

Score

10^/10

suricata upx

Malware Config

Signatures

suricata: ET MALWARE Possible Kelihos.F EXE Download Common Structure
suricata: ET MALWARE Possible Kelihos.F EXE Download Common Structure
suricata

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1080-58-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/1080-61-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/1080-62-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/1080-65-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/1080-66-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/1080-67-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/1080-68-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/1080-69-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/1080-70-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe

description	pid	process	target process
PID 1752 set thread context of 1080	1752	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe

pid process

1752 56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe

pid	process
1752	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe
1752	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe

description	pid	process	target process
PID 1752 wrote to memory of 1080	1752	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe
PID 1752 wrote to memory of 1080	1752	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe
PID 1752 wrote to memory of 1080	1752	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe
PID 1752 wrote to memory of 1080	1752	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe
PID 1752 wrote to memory of 1080	1752	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe
PID 1752 wrote to memory of 1080	1752	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe
PID 1752 wrote to memory of 1080	1752	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe
PID 1752 wrote to memory of 1080	1752	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe
PID 1752 wrote to memory of 1080	1752	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe	56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe

C:\Users\Admin\AppData\Local\Temp\56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe
"C:\Users\Admin\AppData\Local\Temp\56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752

C:\Users\Admin\AppData\Local\Temp\56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe
C:\Users\Admin\AppData\Local\Temp\56785bba1e00883c355dcfa70ac8853d39b026a603eca7a5464254a3c3624099.exe
2⤵
PID:1080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1080-66-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1080-63-0x0000000000407690-mapping.dmp

Download
memory/1080-57-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1080-70-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1080-58-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1080-61-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1080-55-0x00000000001B0000-0x00000000002AA000-memory.dmp

Filesize
1000KB

Download
memory/1080-62-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1080-67-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1080-69-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1080-65-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/1080-68-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1752-54-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download
memory/1752-60-0x0000000000300000-0x0000000000304000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads