Analysis
-
max time kernel
334s -
max time network
385s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 05:40
Static task
static1
Behavioral task
behavioral1
Sample
c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exe
Resource
win10v2004-20221111-en
General
-
Target
c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exe
-
Size
170KB
-
MD5
d5850e323653c6c6704df49be7df3fad
-
SHA1
611f51cbb7417c6f9f9769b8a6dea2639251321a
-
SHA256
c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971
-
SHA512
e1ceefa5e60271415c5c47645ea69cb13bce810f3319a4478d1d862bcb2ca367b10e2a7a8315d5f925598d93bb902e6ae5b85e0c9ac3558f2a7e4a9666034830
-
SSDEEP
3072:Sz5iXfPGUYdmRaUS5+5lcXWiZX3AUPJS/JaGe5jaSshD9SyG9:SNQf+UYmRaUS5oOXwUPAJaGhphDxG9
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Processes:
resource yara_rule behavioral2/memory/2516-134-0x0000000000400000-0x000000000044C000-memory.dmp upx behavioral2/memory/2516-137-0x0000000000400000-0x000000000044C000-memory.dmp upx behavioral2/memory/2516-138-0x0000000000400000-0x000000000044C000-memory.dmp upx behavioral2/memory/2516-139-0x0000000000400000-0x000000000044C000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exe -
Drops file in System32 directory 2 IoCs
Processes:
c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exedescription ioc process File opened for modification C:\Windows\SysWOW64\ c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exe File opened for modification C:\Windows\SysWOW64\wmpnd32.exe c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exedescription pid process target process PID 5016 set thread context of 2516 5016 c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exe c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exepid process 2516 c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exe 2516 c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exe 2516 c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exe 2516 c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exedescription pid process target process PID 5016 wrote to memory of 2516 5016 c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exe c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exe PID 5016 wrote to memory of 2516 5016 c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exe c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exe PID 5016 wrote to memory of 2516 5016 c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exe c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exe PID 5016 wrote to memory of 2516 5016 c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exe c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exe PID 5016 wrote to memory of 2516 5016 c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exe c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exe PID 5016 wrote to memory of 2516 5016 c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exe c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exe PID 5016 wrote to memory of 2516 5016 c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exe c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exe"C:\Users\Admin\AppData\Local\Temp\c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exe"C:\Users\Admin\AppData\Local\Temp\c321f12d46e05106d16e84c43e7a5fb86cf3fc9669c578ded6d30bc5b50f9971.exe"2⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2516-133-0x0000000000000000-mapping.dmp
-
memory/2516-134-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2516-137-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2516-138-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2516-139-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/5016-132-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/5016-135-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB