Resubmissions
18/12/2023, 16:24
231218-twge9sbfbj1018/12/2023, 16:13
231218-tn61ysdbb51016/12/2023, 20:09
231216-yxhryacgdn1016/12/2023, 20:05
231216-yt6dtseba51016/12/2023, 19:50
231216-ykngnacfhr1016/12/2023, 19:47
231216-yhsnlacfhn1016/12/2023, 19:43
231216-yfc55acfgq1016/12/2023, 19:36
231216-ya7gsaeac910Analysis
- max time kernel
117s - max time network
119s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
- submitted
16/12/2023, 19:43
General
- Target A5-leaflet-password-advice-for-ALs-v2.exe
- Size 72KB
- Sample231216-yfc55acfgq
- SHA256 ae16297eb464164e185569833ae2c73d753b21901b876992ffbf12067a518f80
Score
10/10
Malware Config
Extracted
Family
-
metasploit
Version
-
windows/reverse_tcp
C2
-
192.168.64.2:5555
Signatures
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\A5-leaflet-password-advice-for-ALs-v2.exe"C:\Users\Admin\AppData\Local\Temp\A5-leaflet-password-advice-for-ALs-v2.exe"1⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x45c1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2200-0-0x0000000000020000-0x0000000000021000-memory.dmp