Analysis
-
max time kernel
13s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
23-11-2020 10:46
Static task
static1
Behavioral task
behavioral1
Sample
rtaf.jpg.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
rtaf.jpg.exe
Resource
win10v20201028
General
-
Target
rtaf.jpg.exe
-
Size
296KB
-
MD5
ea7054a3d3341793c4cd89cc2f534ab6
-
SHA1
ecbaf2abe657717c225c443b2713811f0a72e5d4
-
SHA256
9813ed4b19619124cbbeefab28ad5f655bb826e0987333e8de016fcd94203d50
-
SHA512
3ca0117dd0733f0d226798e0815d1014fe1ebf22a528073c0e61963710cff2c8c80c1bab184ed45521a04683eb8a15415281010d17130db6a9a1092afbb38f4f
Malware Config
Extracted
metasploit
windows/download_exec
http://45.138.172.81:80/jFIc
- headers User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; MATBJS)
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Executes dropped EXE 1 IoCs
Processes:
artifact.exepid process 2996 artifact.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rtaf.jpg.exedescription pid process target process PID 648 wrote to memory of 2996 648 rtaf.jpg.exe artifact.exe PID 648 wrote to memory of 2996 648 rtaf.jpg.exe artifact.exe PID 648 wrote to memory of 2996 648 rtaf.jpg.exe artifact.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\artifact.exeMD5
49644f6a62c52dbe0bdbdf6a707d1107
SHA1bd72866376f21d6eba990277de33f8d241bd72bb
SHA2561124d79229c729cda68707dbbd352501b139fa8d5f3a96b4bd6dc53b39ae3e37
SHA512f02579d97bf9e585c7409cd54d34ad8ba537818bd8518310eee901fb1ca330911a70b35370ad7f87365712370e95b5fd697c6577117e38f869a1683c9aa80dc9
-
C:\Users\Admin\AppData\Local\Temp\artifact.exeMD5
49644f6a62c52dbe0bdbdf6a707d1107
SHA1bd72866376f21d6eba990277de33f8d241bd72bb
SHA2561124d79229c729cda68707dbbd352501b139fa8d5f3a96b4bd6dc53b39ae3e37
SHA512f02579d97bf9e585c7409cd54d34ad8ba537818bd8518310eee901fb1ca330911a70b35370ad7f87365712370e95b5fd697c6577117e38f869a1683c9aa80dc9
-
memory/2996-2-0x0000000000000000-mapping.dmp
-
memory/2996-5-0x0000000000030000-0x0000000000031000-memory.dmpFilesize
4KB