Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20220812-en
General
-
Target
tmp
-
Size
7KB
-
MD5
d01ca2f3303911da956db961fbcec0df
-
SHA1
6907ac15c5e0440f6e33ab3bcb4e74f7f6c45ddf
-
SHA256
ed3116831b20ca201df61d84acbb0eafe8237ef5ce4a5785028c679072b515ef
-
SHA512
22c4c08b06428b1ace96afbef3b7dbf6225db74f38702aeb6ed0bb3863ec9d849a180523674cce6eed0f8a04edb86dbc102e642e7547dcfff41e437c770ffce1
-
SSDEEP
24:eFGStrJ9u0/6DOnZdkBQAVt1k4KLqUeNDMSCvOXpmB:is0mmkBQK+40SD9C2kB
Malware Config
Extracted
metasploit
metasploit_stager
18.197.94.76:4444
Signatures
-
Metasploit family
Files
-
tmp.exe windows x64
b4c6fff030479aa3b12625be67bf4914
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualAlloc
ExitProcess
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xuoo Size: 1024B - Virtual size: 632B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE