Behavioral task
behavioral1
Sample
hack01.exe
Resource
win7-20230824-en
Behavioral task
behavioral2
Sample
hack01.exe
Resource
win10-20230703-en
Behavioral task
behavioral3
Sample
hack01.exe
Resource
win10v2004-20230703-en
General
-
Target
hack01.exe
-
Size
7KB
-
MD5
e4db81ea98861609908b1409be4ab02b
-
SHA1
71f22e91bfc735c8549330f6bdb40636f1e6d3af
-
SHA256
d2b82fceb7eab10e7cb7f70942b420ac20b0f5047aeddf12c7641c57281afdcd
-
SHA512
2894a4e6559c326ae83172ae01649fd513e8b5aa3888530a5e7de0ea1c7396363b198ed7db95382f4870c0635e030d52839ee1df138846af06eb67437480fa73
-
SSDEEP
24:eFGStrJ9u0/65nLxnZdkBQAVt1c+39KZqreNDMSCvOXpmB:is0QLBkBQK++39dSD9C2kB
Malware Config
Extracted
metasploit
metasploit_stager
192.168.1.19:4444
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource hack01.exe
Files
-
hack01.exe.exe windows x64
b4c6fff030479aa3b12625be67bf4914
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualAlloc
ExitProcess
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.mitv Size: 1024B - Virtual size: 632B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE