Analysis
-
max time kernel
42s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
25-05-2022 21:01
Static task
static1
Behavioral task
behavioral1
Sample
0011b9cd240249c3aeb520ea1205eaf1.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
0011b9cd240249c3aeb520ea1205eaf1.exe
Resource
win10v2004-20220414-en
General
-
Target
0011b9cd240249c3aeb520ea1205eaf1.exe
-
Size
861KB
-
MD5
a145be6638603eddb739eddc9404f2e3
-
SHA1
c38146cbb3c746824c1e827921cdf03bfd19d8a9
-
SHA256
b22d3bb6a0f6661970bfeb1fe03b9cfd148bb3c0b5a7cf7bdd252f5abfc360a7
-
SHA512
cf805f5eb3f832fd1fe583a7ceab1e409ea17eb72b6c97076ce8f01c473b67b8bc79d90538338f5a0b398f27f06ffd5e4f99ec0e7f2bae26b98380cf0d529f02
Malware Config
Extracted
metasploit
windows/download_exec
http://npc.xinchen.space:25565/jquery-3.3.1.slim.min.js
http://c=:25565/jquery-3.3.1.slim.min.js
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
Processes:
0011b9cd240249c3aeb520ea1205eaf1.exepid process 1172 0011b9cd240249c3aeb520ea1205eaf1.exe 1172 0011b9cd240249c3aeb520ea1205eaf1.exe 1172 0011b9cd240249c3aeb520ea1205eaf1.exe 1172 0011b9cd240249c3aeb520ea1205eaf1.exe 1172 0011b9cd240249c3aeb520ea1205eaf1.exe 1172 0011b9cd240249c3aeb520ea1205eaf1.exe 1172 0011b9cd240249c3aeb520ea1205eaf1.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
0011b9cd240249c3aeb520ea1205eaf1.exedescription pid process target process PID 1172 wrote to memory of 1544 1172 0011b9cd240249c3aeb520ea1205eaf1.exe svchost.exe PID 1172 wrote to memory of 1544 1172 0011b9cd240249c3aeb520ea1205eaf1.exe svchost.exe PID 1172 wrote to memory of 1544 1172 0011b9cd240249c3aeb520ea1205eaf1.exe svchost.exe PID 1172 wrote to memory of 1544 1172 0011b9cd240249c3aeb520ea1205eaf1.exe svchost.exe PID 1172 wrote to memory of 1544 1172 0011b9cd240249c3aeb520ea1205eaf1.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0011b9cd240249c3aeb520ea1205eaf1.exe"C:\Users\Admin\AppData\Local\Temp\0011b9cd240249c3aeb520ea1205eaf1.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\System32\svchost.exe"2⤵PID:1544
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1172-54-0x00000000755A1000-0x00000000755A3000-memory.dmpFilesize
8KB
-
memory/1172-56-0x0000000074FB0000-0x0000000074FF7000-memory.dmpFilesize
284KB
-
memory/1172-465-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-466-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-464-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-463-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-462-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-467-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-470-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-471-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-469-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-468-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-472-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-474-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-473-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-476-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-477-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-475-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-478-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-481-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-482-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-480-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-479-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-483-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-485-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-484-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-486-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-490-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-489-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-488-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-487-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-495-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-494-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-493-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-498-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-497-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-496-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-491-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-492-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-501-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-500-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-499-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-523-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-522-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-521-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-520-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-519-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-518-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-517-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-516-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-515-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-514-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-513-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-512-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-511-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-510-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-509-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-508-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-507-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-506-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-505-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-504-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-502-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-503-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-4809-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1172-4810-0x00000000020C0000-0x0000000002241000-memory.dmpFilesize
1.5MB
-
memory/1172-4811-0x0000000002250000-0x0000000002361000-memory.dmpFilesize
1.1MB
-
memory/1172-4812-0x0000000001F80000-0x0000000002081000-memory.dmpFilesize
1.0MB
-
memory/1544-4807-0x0000000000000000-mapping.dmp