Behavioral task
behavioral1
Sample
10f3f0e2b6ba048c39924b4f3208bf313a9f665f6bc71c4ab0f078b970ac77d4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
10f3f0e2b6ba048c39924b4f3208bf313a9f665f6bc71c4ab0f078b970ac77d4.exe
Resource
win10v2004-20220812-en
General
-
Target
10f3f0e2b6ba048c39924b4f3208bf313a9f665f6bc71c4ab0f078b970ac77d4
-
Size
3.5MB
-
MD5
3f1c87184353bcd51cbe35e2dd0d1a48
-
SHA1
e120fb6496dab829be77c4dca0d88eef60fc54eb
-
SHA256
10f3f0e2b6ba048c39924b4f3208bf313a9f665f6bc71c4ab0f078b970ac77d4
-
SHA512
3d5c0e3ab63687a4c1e48681f7828b0d85e76513f564d96ed3692863e9c6ed53486b5f13a0390142e0467fa7d2fea992f81bb1276a9b4b70c20177cef3f204af
-
SSDEEP
98304:arLbxjJgaPts4Effl5QSCWzlCz2D4M1D:a/bxFgAufNqSHB4M1D
Malware Config
Extracted
metasploit
metasploit_stager
10.211.55.7:4444
Signatures
-
Metasploit family
Files
-
10f3f0e2b6ba048c39924b4f3208bf313a9f665f6bc71c4ab0f078b970ac77d4.exe windows x86
7694ef4b0957707eaa1a72332c16f08b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
snmpapi
SnmpUtilOidCpy
SnmpUtilOidNCmp
SnmpSvcGetUptime
netapi32
NetApiBufferFree
NetWkstaUserGetInfo
NetWkstaGetInfo
NetServerGetInfo
odbc32
ord136
ord141
ord24
ord75
ord31
ord9
kernel32
VirtualAlloc
SetConsoleMode
ReadConsoleInputA
PeekConsoleInputA
GetNumberOfConsoleInputEvents
HeapQueryInformation
GetModuleHandleExW
GetACP
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
OutputDebugStringW
VirtualQuery
CreateThread
ExitThread
GetConsoleMode
WriteConsoleW
SetConsoleCtrlHandler
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
InterlockedIncrement
InterlockedDecrement
LocalAlloc
LocalFree
GetLastError
WriteFile
SetEndOfFile
CloseHandle
GetLocalTime
GetCommandLineA
FormatMessageW
GetSystemDirectoryW
CreateFileW
GlobalMemoryStatusEx
SetErrorMode
GetFileSize
ReadFile
FindClose
GetNativeSystemInfo
SystemTimeToFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetTickCount
GetLogicalDriveStringsW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
GetDriveTypeW
GetDiskFreeSpaceExW
FindFirstFileW
GetVolumeInformationW
GetComputerNameW
QueryPerformanceCounter
QueryPerformanceFrequency
MultiByteToWideChar
GetTimeFormatW
GetDateFormatW
LockResource
GetProcAddress
GlobalAlloc
GlobalLock
GlobalUnlock
SetStdHandle
GetModuleFileNameA
GetStringTypeW
GetCPInfo
IsValidCodePage
GetOEMCP
IsValidLocale
EnumSystemLocalesW
LCMapStringW
GetTimeZoneInformation
GetConsoleCP
ReadConsoleW
SetFilePointerEx
FindFirstFileExA
FindFirstFileExW
FindNextFileA
FindNextFileW
GlobalFree
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
WaitForSingleObjectEx
ResetEvent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LocalUnlock
LocalLock
GetUserDefaultLCID
ReplaceFileW
GetTempFileNameW
GetDiskFreeSpaceW
SearchPathW
GetProfileIntW
GetTempPathW
VerifyVersionInfoW
VerSetConditionMask
GetWindowsDirectoryW
GetCurrentDirectoryW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
lstrcpyW
VirtualProtect
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
CompareStringA
GetCurrentThread
SetFileTime
SetFileAttributesW
LocalFileTimeToFileTime
GetFileTime
GetFileSizeEx
GetFileAttributesExW
GetStringTypeExW
MoveFileW
Sleep
LoadResource
SizeofResource
FreeLibraryAndExitThread
lstrcmpiW
DuplicateHandle
UnlockFile
LockFile
GetShortPathNameW
FlushFileBuffers
ResumeThread
SuspendThread
SetThreadPriority
CreateEventW
WaitForSingleObject
SetEvent
GlobalFlags
GlobalFindAtomW
GlobalAddAtomW
lstrcmpW
GlobalDeleteAtom
LoadLibraryA
FreeResource
GetCurrentThreadId
EncodePointer
GetThreadLocale
GetAtomNameW
GlobalGetAtomNameW
lstrcmpA
GetCurrentProcessId
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetModuleHandleA
OutputDebugStringA
CompareStringW
CopyFileW
GlobalSize
SetLastError
SystemTimeToTzSpecificLocalTime
LoadLibraryExW
GetStdHandle
GetFileType
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
RaiseException
FreeLibrary
DecodePointer
WideCharToMultiByte
FindResourceExW
SetFilePointer
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetSystemInfo
SetProcessAffinityMask
GetProcessAffinityMask
IsWow64Process
DeleteFileW
GetFileAttributesW
GetCommandLineW
LoadLibraryW
GetEnvironmentStringsW
GetFullPathNameW
GetVersionExW
GetModuleFileNameW
WaitForMultipleObjects
GetExitCodeProcess
TerminateProcess
ExitProcess
GetCurrentProcess
OpenProcess
CreateDirectoryW
FindResourceW
GetModuleHandleW
MulDiv
user32
GetKeyboardState
ToUnicodeEx
MapVirtualKeyExW
IsCharLowerW
GetKeyboardLayout
WaitMessage
GetComboBoxInfo
ReuseDDElParam
UnpackDDElParam
GetMenuBarInfo
InsertMenuItemW
UpdateLayeredWindow
DrawIcon
CopyIcon
SetCursorPos
BringWindowToTop
GetSystemMenu
DrawStateW
SetParent
SetWindowRgn
SetClassLongW
SetLayeredWindowAttributes
GetKeyNameTextW
MapVirtualKeyW
GetMenuDefaultItem
CreatePopupMenu
NotifyWinEvent
InvertRect
HideCaret
EnableScrollBar
MessageBeep
GetIconInfo
IsRectEmpty
DrawFocusRect
WindowFromPoint
ReleaseCapture
GetNextDlgGroupItem
GetDialogBaseUnits
DeleteMenu
ShowOwnedPopups
TrackMouseEvent
MapDialogRect
GetAsyncKeyState
GetNextDlgTabItem
CreateDialogIndirectParamW
SetRectEmpty
SendDlgItemMessageA
CopyImage
DestroyMenu
GetWindowDC
TabbedTextOutW
GrayStringW
DrawTextExW
CharUpperW
DestroyIcon
RealChildWindowFromPoint
GetDesktopWindow
ClientToScreen
ScrollWindowEx
SendDlgItemMessageW
GetDlgItemInt
SetDlgItemInt
WinHelpW
GetScrollInfo
SetScrollInfo
CallNextHookEx
SetWindowsHookExW
GetWindow
GetTopWindow
GetClassLongW
EqualRect
CreateAcceleratorTableW
RemovePropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
ValidateRect
GetForegroundWindow
SetActiveWindow
TrackPopupMenuEx
SetMenu
GetCapture
GetKeyState
ChildWindowFromPoint
FrameRect
GetSystemMetrics
GetDC
ReleaseDC
GetDlgCtrlID
IsChild
IsMenu
IsWindow
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetMessageTime
GetMessagePos
PeekMessageW
RegisterWindowMessageW
GetLastActivePopup
GetWindowThreadProcessId
IsWindowEnabled
UnhookWindowsHookEx
LoadBitmapW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
GetFocus
RemoveMenu
AppendMenuW
InsertMenuW
GetMenuItemCount
GetMenuItemID
GetMenuState
GetMenuStringW
DialogBoxIndirectParamW
UnregisterClassW
MapWindowPoints
LoadImageW
EnableMenuItem
CheckMenuItem
SetCapture
EmptyClipboard
RegisterClipboardFormatW
SetClipboardData
CloseClipboard
OpenClipboard
DrawEdge
MonitorFromWindow
IsDialogMessageW
LoadStringW
LoadIconW
LoadCursorW
CheckMenuRadioItem
GetClassNameW
EnumChildWindows
GetParent
SetWindowLongW
DestroyAcceleratorTable
CopyAcceleratorTableW
SetRect
LockWindowUpdate
GetDoubleClickTime
ModifyMenuW
CharUpperBuffW
IsClipboardFormatAvailable
GetUpdateRect
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
SubtractRect
SendNotifyMessageW
MonitorFromRect
GetWindowLongW
PtInRect
UnionRect
InSendMessage
CreateMenu
WindowFromDC
GetWindowRgn
DestroyCursor
GetDCEx
GetTabbedTextExtentW
CopyRect
IntersectRect
ScreenToClient
GetCursorPos
SetCursor
MessageBoxW
AdjustWindowRectEx
GetWindowRect
GetClientRect
GetWindowTextLengthW
GetWindowTextW
GetPropW
SetPropW
InvalidateRect
EndPaint
GetSysColor
GetSysColorBrush
SetSysColors
FillRect
InflateRect
OffsetRect
SystemParametersInfoW
MonitorFromPoint
GetMonitorInfoW
EnumDisplayMonitors
GetProcessWindowStation
GetUserObjectInformationW
PostThreadMessageW
SendMessageW
SetWindowTextW
DrawTextW
DrawFrameControl
GetMessageW
TranslateMessage
DispatchMessageW
PostMessageW
DefWindowProcW
PostQuitMessage
CallWindowProcW
RegisterClassExW
CreateWindowExW
DestroyWindow
ShowWindow
MoveWindow
SetWindowPos
GetWindowPlacement
SetWindowPlacement
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
IsWindowVisible
IsIconic
IsZoomed
CreateDialogParamW
DialogBoxParamW
DrawIconEx
EndDialog
GetDlgItem
SetDlgItemTextW
GetDlgItemTextW
CheckDlgButton
CheckRadioButton
IsDlgButtonChecked
DefDlgProcW
SetFocus
GetActiveWindow
SetTimer
KillTimer
EnableWindow
LoadAcceleratorsW
TranslateAcceleratorW
LoadMenuW
GetMenu
GetSubMenu
TrackPopupMenu
GetMenuItemInfoW
SetMenuItemInfoW
SetMenuDefaultItem
UpdateWindow
SetForegroundWindow
BeginPaint
gdi32
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
OffsetClipRgn
PlayMetaFile
PtVisible
RectVisible
RestoreDC
SaveDC
ExtSelectClipRgn
SetMapperFlags
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextCharacterExtra
SetTextAlign
SetTextJustification
PlayMetaFileRecord
EnumMetaFile
ModifyWorldTransform
SetColorAdjustment
ArcTo
PolyDraw
SelectClipPath
SetArcDirection
ExtCreatePen
TextOutW
ExtTextOutW
PolyBezierTo
PolylineTo
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
GetTextExtentPoint32W
CombineRgn
CreateRectRgnIndirect
GetMapMode
GetStockObject
SetRectRgn
DPtoLP
GetTextMetricsW
EnumFontFamiliesExW
GetNearestPaletteIndex
GetBkColor
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
CreateEllipticRgn
Ellipse
GetTextColor
CreatePolygonRgn
Polygon
Polyline
CreateRoundRectRgn
LPtoDP
Rectangle
GetRgnBox
OffsetRgn
GetCurrentObject
GetCharWidthW
StretchDIBits
RoundRect
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
ExtFloodFill
SetPaletteEntries
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
CloseMetaFile
CreateMetaFileW
DeleteMetaFile
AbortDoc
SetAbortProc
GetROP2
GetBkMode
GetPolyFillMode
GetStretchBltMode
GetTextAlign
GetTextFaceW
GetPixel
GetObjectType
GetCurrentPositionEx
GetClipRgn
ExcludeClipRect
GetClipBox
Escape
CreatePatternBrush
CreateHatchBrush
CreateDIBPatternBrushPt
SetBkColor
CreateBitmap
CreateDCW
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreatePalette
CreateRectRgn
CreateSolidBrush
DeleteDC
DeleteObject
GetDeviceCaps
GetDIBits
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
SelectClipRgn
SelectObject
SelectPalette
SetBkMode
StretchBlt
SetStretchBltMode
CreateDIBSection
SetDIBColorTable
GetObjectW
SetBrushOrgEx
UnrealizeObject
GdiFlush
CreatePen
LineTo
SetPixel
MoveToEx
CreateFontIndirectW
EnumFontsW
SetTextColor
UpdateColors
GetDIBColorTable
CreateHalftonePalette
CreateFontW
SetGraphicsMode
SetMapMode
SetWorldTransform
StartDocW
EndDoc
StartPage
EndPage
PatBlt
GetNearestColor
CopyMetaFileW
msimg32
TransparentBlt
AlphaBlend
comdlg32
CommDlgExtendedError
ChooseColorW
GetSaveFileNameW
GetOpenFileNameW
PrintDlgW
winspool.drv
DocumentPropertiesW
GetJobW
ClosePrinter
OpenPrinterW
advapi32
RegisterServiceCtrlHandlerW
RegOpenKeyExW
RegQueryValueExW
SetFileSecurityW
GetFileSecurityW
RegQueryValueW
RegSetValueW
LsaQueryInformationPolicy
LsaOpenPolicy
LsaClose
LsaFreeMemory
SaferComputeTokenFromLevel
SaferIdentifyLevel
SaferCloseLevel
RegCreateKeyW
RegEnumKeyW
RegOpenKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumValueW
RegDeleteKeyW
RegCreateKeyExW
StartServiceW
StartServiceCtrlDispatcherW
SetServiceStatus
RegCloseKey
QueryServiceStatus
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
CloseServiceHandle
RegOpenKeyW
CreateProcessAsUserW
ImpersonateLoggedOnUser
FreeSid
AllocateAndInitializeSid
EqualSid
GetTokenInformation
OpenProcessToken
RevertToSelf
RegSetValueExW
RegDeleteValueW
RegEnumKeyExW
GetUserNameW
ReadEventLogW
OpenEventLogW
CloseEventLog
shell32
Shell_NotifyIconW
SHChangeNotify
ExtractIconW
SHGetFileInfoW
SHAddToRecentDocs
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetDesktopFolder
ShellExecuteExW
SHAppBarMessage
SHBrowseForFolderW
SHGetMalloc
DragFinish
DragQueryFileW
ShellExecuteW
comctl32
CreateToolbarEx
ord17
shlwapi
PathIsUNCW
PathFindFileNameW
PathFindExtensionW
PathRemoveFileSpecW
StrFormatKBSizeW
PathStripToRootW
PathRemoveExtensionW
uxtheme
OpenThemeData
GetThemePartSize
GetThemeSysColor
IsThemeBackgroundPartiallyTransparent
IsAppThemed
GetWindowTheme
GetCurrentThemeName
GetThemeColor
DrawThemeParentBackground
DrawThemeText
DrawThemeBackground
CloseThemeData
ole32
CreateFileMoniker
StgIsStorageFile
StgOpenStorageOnILockBytes
OleTranslateAccelerator
IsAccelerator
OleRegGetMiscStatus
OleRegEnumVerbs
StgOpenStorage
StgCreateDocfile
OleLockRunning
OleSetMenuDescriptor
WriteClassStm
GetHGlobalFromILockBytes
CreateGenericComposite
CreateItemMoniker
OleCreate
OleCreateFromData
OleCreateMenuDescriptor
OleCreateStaticFromData
OleCreateLinkToFile
OleCreateFromFile
OleLoad
OleSave
OleSaveToStream
OleSetContainedObject
CoInitialize
OleGetIconOfClass
CreateDataAdviseHolder
CreateOleAdviseHolder
GetRunningObjectTable
OleIsRunning
CoGetMalloc
OleQueryLinkFromData
OleQueryCreateFromData
CoFreeUnusedLibraries
OleUninitialize
OleCreateLinkFromData
PropVariantCopy
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
CoGetClassObject
CoRegisterClassObject
OleGetClipboard
DoDragDrop
CoInitializeEx
CoCreateGuid
CLSIDFromString
StringFromGUID2
OleIsCurrentClipboard
OleFlushClipboard
OleSetClipboard
CoDisconnectObject
SetConvertStg
OleRegGetUserType
ReleaseStgMedium
OleDuplicateData
ReadFmtUserTypeStg
WriteFmtUserTypeStg
CreateBindCtx
CoTreatAsClass
WriteClassStg
ReadClassStg
CoTaskMemFree
CoTaskMemAlloc
StringFromCLSID
CoSetProxyBlanket
CoInitializeSecurity
OleInitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
CreateStreamOnHGlobal
OleRun
CoCreateInstance
CoUninitialize
CoRevokeClassObject
CoRegisterMessageFilter
CLSIDFromProgID
OleDestroyMenuDescriptor
oleaut32
LoadRegTypeLi
RegisterTypeLi
SysReAllocStringLen
VariantTimeToSystemTime
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayCreate
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
CreateErrorInfo
LoadTypeLi
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayLock
SafeArrayUnlock
SafeArrayUnaccessData
SafeArrayPutElement
SafeArrayCopy
SafeArrayPtrOfIndex
VarDateFromStr
VarCyFromStr
VarBstrFromCy
VarBstrFromDate
VarBstrFromDec
SysAllocStringLen
VariantChangeType
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayGetUBound
SysStringLen
OleLoadPicture
VariantCopy
VariantClear
VariantInit
SystemTimeToVariantTime
SysAllocStringByteLen
VarDecFromStr
SysStringByteLen
SysFreeString
SysAllocString
SafeArrayRedim
GetErrorInfo
SetErrorInfo
SafeArrayAccessData
oledlg
OleUIBusyW
ws2_32
WSAStartup
oleacc
AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject
gdiplus
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipDrawImageRectI
GdipGetImagePaletteSize
GdipCreateFromHDC
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown
GdipCreateBitmapFromHBITMAP
GdipGetImagePalette
GdipSetInterpolationMode
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
imm32
ImmReleaseContext
ImmGetOpenStatus
ImmGetContext
winmm
PlaySoundW
Sections
.text Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 577KB - Virtual size: 577KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 32KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 202KB - Virtual size: 201KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.jbxc Size: 1024B - Virtual size: 692B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 202KB - Virtual size: 201KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ