Analysis
- max time kernel
141s - max time network
144s - platform
windows10_x64 - resource
win10v200722 - submitted
28/08/2020, 13:18
General
- Target f15491b940bdf60bc4e906b0c333ea3f7a7f38079a906b80a212901eb5ce0152.exe
- Size 31KB
- Sample200828-gd3t7112be
- SHA256 f15491b940bdf60bc4e906b0c333ea3f7a7f38079a906b80a212901eb5ce0152
Malware Config
Extracted
-
metasploit
-
windows/download_exec
-
http://104.233.224.237:4389/vv79
- headers User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Firefox/24.0
Signatures
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f15491b940bdf60bc4e906b0c333ea3f7a7f38079a906b80a212901eb5ce0152.exe"C:\Users\Admin\AppData\Local\Temp\f15491b940bdf60bc4e906b0c333ea3f7a7f38079a906b80a212901eb5ce0152.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3556-9-0x0000000000400000-0x0000000000409000-memory.dmp
memory/3556-11-0x0000000000400000-0x0000000000409000-memory.dmp
memory/3556-12-0x0000000001490000-0x0000000001491000-memory.dmp
memory/3712-0-0x0000000073FA0000-0x000000007468E000-memory.dmp
memory/3712-1-0x0000000000130000-0x0000000000131000-memory.dmp
memory/3712-3-0x00000000050A0000-0x00000000050A1000-memory.dmp
memory/3712-4-0x0000000004AC0000-0x0000000004AC1000-memory.dmp
memory/3712-5-0x0000000004AA0000-0x0000000004AA1000-memory.dmp
memory/3712-6-0x0000000004D80000-0x0000000004D81000-memory.dmp
memory/3712-7-0x0000000004AB0000-0x0000000004AB6000-memory.dmp
memory/3712-8-0x0000000004D20000-0x0000000004D21000-memory.dmp