Analysis
- max time kernel
147s - max time network
164s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
18/03/2023, 11:16
General
- Target b5f1e89070c0c5eef7d8fa9950f38eda.exe
- Size 72KB
- Sample230318-nc5e4aca74
- SHA256 1ab3517feb46b2eca39547915f8f6565b05011ce8674e784d96e2484df39c8bb
Malware Config
Extracted
-
metasploit
-
windows/reverse_tcp
-
3.141.204.47:28193
Signatures
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5f1e89070c0c5eef7d8fa9950f38eda.exe"C:\Users\Admin\AppData\Local\Temp\b5f1e89070c0c5eef7d8fa9950f38eda.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\System32\notepad.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1584-190-0x0000000004840000-0x0000000004871000-memory.dmp
memory/1584-211-0x0000000004A00000-0x0000000004A5F000-memory.dmp
memory/1584-209-0x0000000004A00000-0x0000000004A5F000-memory.dmp
memory/1584-207-0x0000000004A60000-0x0000000004A80000-memory.dmp
memory/1584-204-0x0000000004840000-0x0000000004871000-memory.dmp
memory/1584-201-0x0000000004A00000-0x0000000004A5F000-memory.dmp
memory/1584-196-0x0000000004840000-0x0000000004871000-memory.dmp
memory/1584-191-0x00000000046B0000-0x00000000046DB000-memory.dmp
memory/1584-186-0x00000000046B0000-0x00000000046DB000-memory.dmp
memory/1584-187-0x0000000004840000-0x0000000004871000-memory.dmp
memory/2732-148-0x0000000002560000-0x00000000025BF000-memory.dmp
memory/2732-188-0x0000000000600000-0x0000000000631000-memory.dmp
memory/2732-189-0x0000000002560000-0x00000000025BF000-memory.dmp
memory/2732-166-0x0000000000560000-0x0000000000580000-memory.dmp
memory/2732-162-0x0000000000600000-0x0000000000631000-memory.dmp
memory/2732-133-0x00000000005A0000-0x00000000005A1000-memory.dmp
memory/2732-146-0x0000000000600000-0x0000000000631000-memory.dmp
memory/2732-137-0x0000000000600000-0x0000000000631000-memory.dmp
memory/2732-135-0x0000000000600000-0x0000000000631000-memory.dmp
memory/2732-134-0x00000000005D0000-0x00000000005FB000-memory.dmp