Behavioral task
behavioral1
Sample
f2922a4e331acd5f567f30fa41a8fa06986b22c81c833c177ab4a7d434cd9145.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
f2922a4e331acd5f567f30fa41a8fa06986b22c81c833c177ab4a7d434cd9145.exe
Resource
win10v2004-20231020-en
General
-
Target
f2922a4e331acd5f567f30fa41a8fa06986b22c81c833c177ab4a7d434cd9145
-
Size
27KB
-
MD5
02061b49edafff8a4d1b794e21be3b87
-
SHA1
f5dc846c5f9f2d171d2aca188377e2e439787b77
-
SHA256
f2922a4e331acd5f567f30fa41a8fa06986b22c81c833c177ab4a7d434cd9145
-
SHA512
2b52dceaf565bea7da025982c558c6da71c40d0de5c3e30f1762e4c824a29561a306bf6f8e4c2acc03b5991a01e8b0c1538df0e34184645686d4a0e1a273d417
-
SSDEEP
768:6TZi3u79UotAXZP9CZuZwkMgr8QX0RmlJvH3:6TTUotGZGuekMgQQX0RmlRH
Malware Config
Extracted
metasploit
windows/download_exec
http://192.168.16.129:80/HtNR
- headers User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; ASU2JS)
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f2922a4e331acd5f567f30fa41a8fa06986b22c81c833c177ab4a7d434cd9145
Files
-
f2922a4e331acd5f567f30fa41a8fa06986b22c81c833c177ab4a7d434cd9145.exe windows:6 windows x86
4be4003ed431a03f8c55ada312720ac0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
vcruntime140
__current_exception
__current_exception_context
memset
_except_handler4_common
api-ms-win-crt-runtime-l1-1-0
_exit
_initialize_onexit_table
_register_onexit_function
__p___argv
_controlfp_s
terminate
exit
_cexit
__p___argc
_initterm_e
_crt_atexit
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_c_exit
_set_app_type
_seh_filter_exe
_register_thread_local_exe_atexit_callback
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
kernel32
GetCurrentProcessId
GetModuleHandleW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
UnhandledExceptionFilter
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 876B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 824B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 344B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ