Analysis
-
max time kernel
141s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
24/08/2023, 09:51
Behavioral task
behavioral1
Sample
3eb786e3580c5769a3ca9ffb93a38f41712b84774ec40432b11aa522061f24bb.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
3eb786e3580c5769a3ca9ffb93a38f41712b84774ec40432b11aa522061f24bb.exe
Resource
win10v2004-20230703-en
General
-
Target
3eb786e3580c5769a3ca9ffb93a38f41712b84774ec40432b11aa522061f24bb.exe
-
Size
527KB
-
MD5
16573eed2efc2fe0d699e2ea7069917b
-
SHA1
8bdc21400cfec085451e23dcf6aa29a2c35c399b
-
SHA256
3eb786e3580c5769a3ca9ffb93a38f41712b84774ec40432b11aa522061f24bb
-
SHA512
b62217294f4738c9e9f796d19080cb4dd6b0cb2a53d3c9d4c77a8eabc4b0087e4ee967922758737e53ab250742288cb9cd6a21f9e6e2f2044d875c5d7a5aa93c
-
SSDEEP
12288:qstjgayIDpGzrw/Kz6q0Qqf7YPhkp+VdcLpIC1uDOdKDf9FJ:Fjg5WpGzrw8iLY5kp+VdcL6coDf9X
Malware Config
Extracted
metasploit
metasploit_stager
43.163.204.20:54444
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
resource yara_rule behavioral1/memory/1912-0-0x0000000000E80000-0x0000000001020000-memory.dmp upx behavioral1/memory/1912-1-0x0000000000E80000-0x0000000001020000-memory.dmp upx behavioral1/memory/1912-6-0x0000000000E80000-0x0000000001020000-memory.dmp upx behavioral1/memory/1912-52-0x0000000000E80000-0x0000000001020000-memory.dmp upx behavioral1/memory/1912-64-0x0000000000E80000-0x0000000001020000-memory.dmp upx