Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
25-07-2022 04:14
Static task
static1
Behavioral task
behavioral1
Sample
564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exe
Resource
win10v2004-20220721-en
General
-
Target
564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exe
-
Size
94KB
-
MD5
57d1c762330334d1a8a792ccf25ef573
-
SHA1
ad79f7455cbfb6be0a728aa7d59532a71ff4579c
-
SHA256
564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52
-
SHA512
180e43efeb64a28c30c43f738ddef65e72db84ddfeb96137031c8566f93da7e9eb2126b4e7f604167fd67c0a7880cbb8a344c69bd45dd3b279a330f4e97244e0
Malware Config
Signatures
-
suricata: ET MALWARE Possible Kelihos.F EXE Download Common Structure
suricata: ET MALWARE Possible Kelihos.F EXE Download Common Structure
-
Processes:
resource yara_rule behavioral1/memory/1968-58-0x0000000000400000-0x0000000002B10000-memory.dmp upx behavioral1/memory/1968-61-0x0000000000400000-0x0000000002B10000-memory.dmp upx behavioral1/memory/1968-64-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/memory/1968-62-0x0000000000400000-0x0000000002B10000-memory.dmp upx behavioral1/memory/1968-66-0x0000000000400000-0x0000000002B10000-memory.dmp upx behavioral1/memory/1968-67-0x0000000000400000-0x0000000002B10000-memory.dmp upx behavioral1/memory/1968-68-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/memory/1968-69-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exedescription pid process target process PID 1956 set thread context of 1968 1956 564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exe 564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exe564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exepid process 1956 564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exe 1968 564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exe 1968 564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exe 1968 564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exe 1968 564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exe 1968 564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exepid process 1956 564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exedescription pid process target process PID 1956 wrote to memory of 1968 1956 564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exe 564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exe PID 1956 wrote to memory of 1968 1956 564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exe 564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exe PID 1956 wrote to memory of 1968 1956 564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exe 564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exe PID 1956 wrote to memory of 1968 1956 564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exe 564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exe PID 1956 wrote to memory of 1968 1956 564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exe 564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exe PID 1956 wrote to memory of 1968 1956 564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exe 564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exe PID 1956 wrote to memory of 1968 1956 564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exe 564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exe PID 1956 wrote to memory of 1968 1956 564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exe 564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exe PID 1956 wrote to memory of 1968 1956 564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exe 564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exe"C:\Users\Admin\AppData\Local\Temp\564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exe"C:\Users\Admin\AppData\Local\Temp\564efdeb29e76b20cb6f4432edbee240ae74ceb3617cce1c65bc1ba0003fce52.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1956-59-0x00000000003E0000-0x00000000003E4000-memory.dmpFilesize
16KB
-
memory/1956-54-0x00000000756B1000-0x00000000756B3000-memory.dmpFilesize
8KB
-
memory/1968-63-0x0000000000408AC0-mapping.dmp
-
memory/1968-57-0x0000000000400000-0x0000000002B10000-memory.dmpFilesize
39.1MB
-
memory/1968-58-0x0000000000400000-0x0000000002B10000-memory.dmpFilesize
39.1MB
-
memory/1968-61-0x0000000000400000-0x0000000002B10000-memory.dmpFilesize
39.1MB
-
memory/1968-55-0x00000000001B0000-0x00000000002AA000-memory.dmpFilesize
1000KB
-
memory/1968-64-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1968-62-0x0000000000400000-0x0000000002B10000-memory.dmpFilesize
39.1MB
-
memory/1968-66-0x0000000000400000-0x0000000002B10000-memory.dmpFilesize
39.1MB
-
memory/1968-67-0x0000000000400000-0x0000000002B10000-memory.dmpFilesize
39.1MB
-
memory/1968-68-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1968-69-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB