Behavioral task
behavioral1
Sample
83b1bc22867568240fee839b894cabe89b77b99dd6895b5910217285a051e0ac.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
83b1bc22867568240fee839b894cabe89b77b99dd6895b5910217285a051e0ac.exe
Resource
win10v2004-20231023-en
General
-
Target
83b1bc22867568240fee839b894cabe89b77b99dd6895b5910217285a051e0ac
-
Size
1.2MB
-
MD5
b20c32dc04b1aa5509511e1923aa9329
-
SHA1
d183b67664eb7bb871be739d323c2794a4619645
-
SHA256
83b1bc22867568240fee839b894cabe89b77b99dd6895b5910217285a051e0ac
-
SHA512
89c3dd92bcff693bc4ec255160b7eccae53ffc5bbdd233a76e9b14b2fa8ec51f65c97d0e069406825a64edbb8a1f6a7740040f96f8f5154ca4521590151205d6
-
SSDEEP
24576:l0zNUFole0vjq3qcQlyZLmBreczDVmSBy15LbCbLO3h34cup/d5aGwLZJTqNh+Wy:FLbaYgMO8m
Malware Config
Extracted
metasploit
windows/reverse_tcp
192.168.175.131:2333
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 83b1bc22867568240fee839b894cabe89b77b99dd6895b5910217285a051e0ac
Files
-
83b1bc22867568240fee839b894cabe89b77b99dd6895b5910217285a051e0ac.exe windows:6 windows x64 arch:x64
c2dee9c6693ce5e6daf95aa1fb6c7f5b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetSystemInfo
GetTickCount64
lstrcmpiW
GetComputerNameW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
K32EnumProcesses
CloseHandle
OpenProcess
VirtualAllocEx
GlobalMemoryStatusEx
GetModuleHandleW
GetProcAddress
WaitForSingleObject
ExitProcess
CreateThread
GetExitCodeThread
CreateFileW
GetConsoleOutputCP
FlushFileBuffers
GetProcessHeap
HeapAlloc
GetDiskFreeSpaceExW
FindNextFileW
SetFilePointerEx
GetFileSizeEx
WriteProcessMemory
FindFirstFileW
GetCurrentThreadId
IsDebuggerPresent
RaiseException
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetLastError
HeapFree
VirtualQuery
FreeLibrary
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
GetModuleFileNameW
LoadLibraryExW
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RtlPcToFileHeader
GetModuleHandleExW
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
HeapSize
HeapValidate
GetFileType
OutputDebugStringW
WriteConsoleW
SetConsoleCtrlHandler
GetCurrentThread
FindClose
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTempPathW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
HeapReAlloc
HeapQueryInformation
ReadFile
GetConsoleMode
ReadConsoleW
RtlUnwind
user32
CharUpperW
advapi32
RegOpenKeyExW
RegQueryInfoKeyW
GetUserNameW
shell32
SHGetKnownFolderPath
iphlpapi
GetAdaptersAddresses
Sections
.textbss Size: - Virtual size: 440KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 934KB - Virtual size: 933KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 214KB - Virtual size: 214KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.msvcjmc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: 512B - Virtual size: 373B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 1024B - Virtual size: 671B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ