Analysis
-
max time kernel
125s -
max time network
127s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
11-11-2020 10:53
Static task
static1
Behavioral task
behavioral1
Sample
9b5063189c2dd0550c422662883b23b243a72d97a8d55e80236328aed1625a3c.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
9b5063189c2dd0550c422662883b23b243a72d97a8d55e80236328aed1625a3c.exe
Resource
win10v20201028
General
-
Target
9b5063189c2dd0550c422662883b23b243a72d97a8d55e80236328aed1625a3c.exe
-
Size
3.3MB
-
MD5
8c0c79a1d225b583724e6d6cb97d2640
-
SHA1
d86f98b0f4c965a2f5e41ebdeb54388890967450
-
SHA256
9b5063189c2dd0550c422662883b23b243a72d97a8d55e80236328aed1625a3c
-
SHA512
6029b4df1048897d941682bc1379d27017f5d0cc2b6724ee5a46c5b54f2f41cb8c2d10e7beca56ec214c77a51a2364dbf5341ef4279af707767659a95671ce18
Malware Config
Extracted
metasploit
windows/download_exec
http://47.91.237.42:8443/blIF
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Processes:
resource yara_rule behavioral2/memory/4760-0-0x0000000000400000-0x0000000000A0E000-memory.dmp vmprotect
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4760-0-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB