Behavioral task
behavioral1
Sample
211283b0e29dfa777f91873b66aeca733a478e4acd49eb6c790e593c037558d0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
211283b0e29dfa777f91873b66aeca733a478e4acd49eb6c790e593c037558d0.exe
Resource
win10v2004-20220812-en
General
-
Target
211283b0e29dfa777f91873b66aeca733a478e4acd49eb6c790e593c037558d0
-
Size
99KB
-
MD5
a494d1a78edfe33d55fa23afd3c03dae
-
SHA1
b02c9961b7ab9f089528e9411589f69941ab79f9
-
SHA256
211283b0e29dfa777f91873b66aeca733a478e4acd49eb6c790e593c037558d0
-
SHA512
f91ba4fad99f5ec2225b0bd5bf7ac65b3f7e52f3898160ef4e3977fa16efc6dbcf3affc8e07003510afb0c73926c8dcf551c1bd1833317b4e46710485b84e4d8
-
SSDEEP
1536:vTS0F00fqdNRD0NufVGbgdiGz03oh1LV9wC:vTSQ00fqdNRD0NufVGbgdiGz04h1Lz
Malware Config
Extracted
metasploit
windows/download_exec
http://10.211.55.2:8000/hAeN
- headers User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUS)
Signatures
-
Metasploit family
Files
-
211283b0e29dfa777f91873b66aeca733a478e4acd49eb6c790e593c037558d0.exe windows x86
17a6d8ade6d55e45a5c568d958c0d0a0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualFree
GetModuleHandleA
GetProcAddress
WideCharToMultiByte
AllocConsole
VirtualProtect
CreateToolhelp32Snapshot
Process32First
Process32Next
VirtualQuery
GetProcessHeap
HeapFree
GetTickCount64
GetSystemInfo
GetConsoleWindow
GlobalMemoryStatusEx
HeapAlloc
GetLastError
GetModuleHandleW
GetStartupInfoW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
MultiByteToWideChar
RaiseException
IsDebuggerPresent
GetCurrentThreadId
FreeLibrary
user32
ShowWindow
comctl32
ord386
ord328
ord334
vcruntime140d
memmove
memset
__std_type_info_destroy_list
__current_exception
__current_exception_context
_except_handler4_common
__vcrt_GetModuleFileNameW
__vcrt_GetModuleHandleW
__vcrt_LoadLibraryExW
strstr
ucrtbased
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_configthreadlocale
_set_new_mode
__p__commode
strcpy_s
__stdio_common_vsprintf_s
_seh_filter_dll
_initialize_onexit_table
_register_onexit_function
_exit
_crt_atexit
_crt_at_quick_exit
_controlfp_s
terminate
_wmakepath_s
_wsplitpath_s
wcscpy_s
clock
_pclose
fgets
feof
exit
strcmp
strcat_s
_set_fmode
_initterm_e
_initterm
_popen
_initialize_narrow_environment
_configure_narrow_argv
__setusermatherr
_set_app_type
_seh_filter_exe
_CrtDbgReport
_CrtDbgReportW
_execute_onexit_table
_access
_get_initial_narrow_environment
Sections
.textbss Size: - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.msvcjmc Size: 512B - Virtual size: 310B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: 512B - Virtual size: 265B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 55KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ