Analysis
-
max time kernel
50s -
max time network
14s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
23-11-2020 10:46
Static task
static1
Behavioral task
behavioral1
Sample
rtaf.jpg.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
rtaf.jpg.exe
Resource
win10v20201028
General
-
Target
rtaf.jpg.exe
-
Size
296KB
-
MD5
ea7054a3d3341793c4cd89cc2f534ab6
-
SHA1
ecbaf2abe657717c225c443b2713811f0a72e5d4
-
SHA256
9813ed4b19619124cbbeefab28ad5f655bb826e0987333e8de016fcd94203d50
-
SHA512
3ca0117dd0733f0d226798e0815d1014fe1ebf22a528073c0e61963710cff2c8c80c1bab184ed45521a04683eb8a15415281010d17130db6a9a1092afbb38f4f
Malware Config
Extracted
metasploit
windows/download_exec
http://45.138.172.81:80/jFIc
- headers User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; MATBJS)
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Executes dropped EXE 1 IoCs
Processes:
artifact.exepid process 1996 artifact.exe -
Loads dropped DLL 4 IoCs
Processes:
rtaf.jpg.exepid process 292 rtaf.jpg.exe 292 rtaf.jpg.exe 292 rtaf.jpg.exe 292 rtaf.jpg.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
DllHost.exepid process 1972 DllHost.exe 1972 DllHost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
rtaf.jpg.exedescription pid process target process PID 292 wrote to memory of 1996 292 rtaf.jpg.exe artifact.exe PID 292 wrote to memory of 1996 292 rtaf.jpg.exe artifact.exe PID 292 wrote to memory of 1996 292 rtaf.jpg.exe artifact.exe PID 292 wrote to memory of 1996 292 rtaf.jpg.exe artifact.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\rtaf.jpg.exe"C:\Users\Admin\AppData\Local\Temp\rtaf.jpg.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\artifact.exe"C:\Users\Admin\AppData\Local\Temp\artifact.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\artifact.exeMD5
49644f6a62c52dbe0bdbdf6a707d1107
SHA1bd72866376f21d6eba990277de33f8d241bd72bb
SHA2561124d79229c729cda68707dbbd352501b139fa8d5f3a96b4bd6dc53b39ae3e37
SHA512f02579d97bf9e585c7409cd54d34ad8ba537818bd8518310eee901fb1ca330911a70b35370ad7f87365712370e95b5fd697c6577117e38f869a1683c9aa80dc9
-
C:\Users\Admin\AppData\Local\Temp\rtaf.jpgMD5
395b352380dd10cb6501c8156592029b
SHA147c8621374606f3ddedb03b433add3f80286d647
SHA2564a000f8cf3c5875525096b938a5e3ad003fe383de67ccb062e3540a30f102b97
SHA51250e3db253d3525b530940552e639440fb95442994d9e0b0a06893eee440fbcb532f1ca1ab1cdbd30e8450f1fee82b5c6f180fc94e1ca24ef6eda6fb36d7a3e8e
-
\Users\Admin\AppData\Local\Temp\artifact.exeMD5
49644f6a62c52dbe0bdbdf6a707d1107
SHA1bd72866376f21d6eba990277de33f8d241bd72bb
SHA2561124d79229c729cda68707dbbd352501b139fa8d5f3a96b4bd6dc53b39ae3e37
SHA512f02579d97bf9e585c7409cd54d34ad8ba537818bd8518310eee901fb1ca330911a70b35370ad7f87365712370e95b5fd697c6577117e38f869a1683c9aa80dc9
-
\Users\Admin\AppData\Local\Temp\artifact.exeMD5
49644f6a62c52dbe0bdbdf6a707d1107
SHA1bd72866376f21d6eba990277de33f8d241bd72bb
SHA2561124d79229c729cda68707dbbd352501b139fa8d5f3a96b4bd6dc53b39ae3e37
SHA512f02579d97bf9e585c7409cd54d34ad8ba537818bd8518310eee901fb1ca330911a70b35370ad7f87365712370e95b5fd697c6577117e38f869a1683c9aa80dc9
-
\Users\Admin\AppData\Local\Temp\artifact.exeMD5
49644f6a62c52dbe0bdbdf6a707d1107
SHA1bd72866376f21d6eba990277de33f8d241bd72bb
SHA2561124d79229c729cda68707dbbd352501b139fa8d5f3a96b4bd6dc53b39ae3e37
SHA512f02579d97bf9e585c7409cd54d34ad8ba537818bd8518310eee901fb1ca330911a70b35370ad7f87365712370e95b5fd697c6577117e38f869a1683c9aa80dc9
-
\Users\Admin\AppData\Local\Temp\artifact.exeMD5
49644f6a62c52dbe0bdbdf6a707d1107
SHA1bd72866376f21d6eba990277de33f8d241bd72bb
SHA2561124d79229c729cda68707dbbd352501b139fa8d5f3a96b4bd6dc53b39ae3e37
SHA512f02579d97bf9e585c7409cd54d34ad8ba537818bd8518310eee901fb1ca330911a70b35370ad7f87365712370e95b5fd697c6577117e38f869a1683c9aa80dc9
-
memory/592-8-0x000007FEF6580000-0x000007FEF67FA000-memory.dmpFilesize
2.5MB
-
memory/1996-4-0x0000000000000000-mapping.dmp
-
memory/1996-6-0x0000000000020000-0x0000000000021000-memory.dmpFilesize
4KB