562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb

General

Target

562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe
Size

65KB
MD5

52849cc043bf31bd8c0199717e878b49
SHA1

99dd1f392c69a852770e16ea8357978b0ce47039
SHA256

562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb
SHA512

7f3ccf1c5c28d3038aff8fa42200f1dea94456a8f1bfb7c2d0a47bb855a76fda6a2663aceefc9e4cd5c8b65a1746db7d0f4d6336ece780b5c1631207d9b4e1c0

Score

10^/10

suricata upx

Malware Config

Signatures

suricata: ET MALWARE Possible Kelihos.F EXE Download Common Structure
suricata: ET MALWARE Possible Kelihos.F EXE Download Common Structure
suricata

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/560-58-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/560-60-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/560-61-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/860-62-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/560-67-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/560-68-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/560-69-0x0000000000400000-0x0000000002728000-memory.dmp	upx
behavioral1/memory/560-70-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/560-71-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe

description	pid	process	target process
PID 860 set thread context of 560	860	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe

pid process

860 562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe

pid process

860 562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe

pid	process
860	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe

pid	process
860	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe

description	pid	process	target process
PID 860 wrote to memory of 560	860	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe
PID 860 wrote to memory of 560	860	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe
PID 860 wrote to memory of 560	860	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe
PID 860 wrote to memory of 560	860	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe
PID 860 wrote to memory of 560	860	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe
PID 860 wrote to memory of 560	860	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe
PID 860 wrote to memory of 560	860	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe
PID 860 wrote to memory of 560	860	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe
PID 860 wrote to memory of 560	860	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe	562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe

C:\Users\Admin\AppData\Local\Temp\562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe
"C:\Users\Admin\AppData\Local\Temp\562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:860

C:\Users\Admin\AppData\Local\Temp\562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe
C:\Users\Admin\AppData\Local\Temp\562faf7c724f0b93755127899fe084113406e16a6226c1c83d6ceb0bf2b433cb.exe
2⤵
PID:560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/560-63-0x00000000004076D0-mapping.dmp

Download
memory/560-67-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/560-57-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/560-58-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/560-60-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/560-61-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/560-55-0x00000000001B0000-0x00000000002AA000-memory.dmp

Filesize
1000KB

Download
memory/560-71-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/560-70-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/560-69-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/560-68-0x0000000000400000-0x0000000002728000-memory.dmp

Filesize
35.2MB

Download
memory/860-64-0x0000000000240000-0x0000000000250000-memory.dmp

Filesize
64KB

Download
memory/860-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/860-62-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/860-66-0x0000000000250000-0x0000000000254000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads