Analysis
- max time kernel
137s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
06/01/2024, 23:31
General
- Target 4772c058861a05be7a7fd654931e3c25.exe
- Size 374KB
- Sample240106-3hr5aaacdl
- SHA256 82ecbaa97f176fc0115ac32d7a7c4cfee4585bc84eb21cd6848a0d01248b2779
Malware Config
Extracted
-
metasploit
-
encoder/call4_dword_xor
Signatures
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Executes dropped EXE 10 IoCs
- Drops file in System32 directory 20 IoCs
- Suspicious use of WriteProcessMemory 30 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4772c058861a05be7a7fd654931e3c25.exe"C:\Users\Admin\AppData\Local\Temp\4772c058861a05be7a7fd654931e3c25.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wuauclt11.exeC:\Windows\system32\wuauclt11.exe 1148 "C:\Users\Admin\AppData\Local\Temp\4772c058861a05be7a7fd654931e3c25.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wuauclt11.exeC:\Windows\system32\wuauclt11.exe 1152 "C:\Windows\SysWOW64\wuauclt11.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wuauclt11.exeC:\Windows\system32\wuauclt11.exe 1120 "C:\Windows\SysWOW64\wuauclt11.exe"4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wuauclt11.exeC:\Windows\system32\wuauclt11.exe 1124 "C:\Windows\SysWOW64\wuauclt11.exe"5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wuauclt11.exeC:\Windows\system32\wuauclt11.exe 1128 "C:\Windows\SysWOW64\wuauclt11.exe"6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wuauclt11.exeC:\Windows\system32\wuauclt11.exe 1132 "C:\Windows\SysWOW64\wuauclt11.exe"7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wuauclt11.exeC:\Windows\system32\wuauclt11.exe 1136 "C:\Windows\SysWOW64\wuauclt11.exe"8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wuauclt11.exeC:\Windows\system32\wuauclt11.exe 1140 "C:\Windows\SysWOW64\wuauclt11.exe"9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wuauclt11.exeC:\Windows\system32\wuauclt11.exe 1144 "C:\Windows\SysWOW64\wuauclt11.exe"10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wuauclt11.exeC:\Windows\system32\wuauclt11.exe 1156 "C:\Windows\SysWOW64\wuauclt11.exe"11⤵
- Executes dropped EXE
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
wuauclt11.exe
wuauclt11.exe
wuauclt11.exe
wuauclt11.exe
memory/60-900-0x0000000000400000-0x0000000000525000-memory.dmp
memory/2564-765-0x0000000000400000-0x0000000000525000-memory.dmp
memory/2964-426-0x0000000000400000-0x0000000000525000-memory.dmp
memory/3032-41-0x0000000002A10000-0x0000000002A2B000-memory.dmp
memory/3032-32-0x0000000002A10000-0x0000000002A2B000-memory.dmp
memory/3032-9-0x00000000023B0000-0x00000000023B1000-memory.dmp
memory/3032-10-0x0000000002930000-0x000000000293A000-memory.dmp
memory/3032-11-0x00000000029B0000-0x00000000029B1000-memory.dmp
memory/3032-12-0x0000000002990000-0x0000000002991000-memory.dmp
memory/3032-38-0x0000000002A10000-0x0000000002A2B000-memory.dmp
memory/3032-63-0x0000000002A10000-0x0000000002A2B000-memory.dmp
memory/3032-62-0x0000000002A10000-0x0000000002A2B000-memory.dmp
memory/3032-36-0x0000000002A10000-0x0000000002A2B000-memory.dmp
memory/3032-60-0x0000000002A10000-0x0000000002A2B000-memory.dmp
memory/3032-59-0x0000000002A10000-0x0000000002A2B000-memory.dmp
memory/3032-3-0x0000000002420000-0x0000000002421000-memory.dmp
memory/3032-4-0x00000000023A0000-0x00000000023A1000-memory.dmp
memory/3032-58-0x0000000002A10000-0x0000000002A2B000-memory.dmp
memory/3032-57-0x0000000002A10000-0x0000000002A2B000-memory.dmp
memory/3032-56-0x0000000002A10000-0x0000000002A2B000-memory.dmp
memory/3032-55-0x0000000002A10000-0x0000000002A2B000-memory.dmp
memory/3032-54-0x0000000002A10000-0x0000000002A2B000-memory.dmp
memory/3032-229-0x0000000000400000-0x0000000000525000-memory.dmp
memory/3032-53-0x0000000002A10000-0x0000000002A2B000-memory.dmp
memory/3032-52-0x0000000002A10000-0x0000000002A2B000-memory.dmp
memory/3032-51-0x0000000002A10000-0x0000000002A2B000-memory.dmp
memory/3032-50-0x0000000002A10000-0x0000000002A2B000-memory.dmp
memory/3032-49-0x0000000002A10000-0x0000000002A2B000-memory.dmp
memory/3032-48-0x0000000002A10000-0x0000000002A2B000-memory.dmp
memory/3032-47-0x0000000002A10000-0x0000000002A2B000-memory.dmp
memory/3032-46-0x0000000002A10000-0x0000000002A2B000-memory.dmp
memory/3032-45-0x0000000002A10000-0x0000000002A2B000-memory.dmp
memory/3032-44-0x0000000002A10000-0x0000000002A2B000-memory.dmp
memory/3032-43-0x0000000002A10000-0x0000000002A2B000-memory.dmp
memory/3032-0-0x0000000000400000-0x0000000000525000-memory.dmp
memory/3032-40-0x0000000002A10000-0x0000000002A2B000-memory.dmp
memory/3032-39-0x0000000002A10000-0x0000000002A2B000-memory.dmp
memory/3032-42-0x0000000002A10000-0x0000000002A2B000-memory.dmp
memory/3032-2-0x00000000023F0000-0x00000000023F1000-memory.dmp
memory/3032-61-0x0000000002A10000-0x0000000002A2B000-memory.dmp
memory/3032-35-0x0000000002A10000-0x0000000002A2B000-memory.dmp
memory/3032-34-0x0000000002A10000-0x0000000002A2B000-memory.dmp
memory/3032-33-0x0000000002A10000-0x0000000002A2B000-memory.dmp
memory/3032-37-0x0000000002A10000-0x0000000002A2B000-memory.dmp
memory/3032-31-0x0000000002A10000-0x0000000002A2B000-memory.dmp
memory/3032-30-0x00000000029F0000-0x00000000029F1000-memory.dmp
memory/3032-29-0x0000000002A00000-0x0000000002A01000-memory.dmp
memory/3032-28-0x00000000029E0000-0x00000000029E1000-memory.dmp
memory/3032-27-0x00000000029D0000-0x00000000029D1000-memory.dmp
memory/3032-26-0x00000000029C0000-0x00000000029C1000-memory.dmp
memory/3032-25-0x0000000002660000-0x0000000002661000-memory.dmp
memory/3032-24-0x00000000027F0000-0x00000000027F1000-memory.dmp
memory/3032-23-0x00000000025B0000-0x00000000025B1000-memory.dmp
memory/3032-22-0x0000000002970000-0x0000000002971000-memory.dmp
memory/3032-21-0x0000000002980000-0x0000000002981000-memory.dmp
memory/3032-20-0x0000000002500000-0x0000000002501000-memory.dmp
memory/3032-19-0x0000000002450000-0x0000000002451000-memory.dmp
memory/3032-18-0x0000000002960000-0x0000000002961000-memory.dmp
memory/3032-17-0x00000000022D0000-0x00000000022D1000-memory.dmp
memory/3032-16-0x00000000022C0000-0x00000000022C1000-memory.dmp
memory/3032-15-0x0000000002950000-0x0000000002951000-memory.dmp
memory/3032-14-0x00000000029A0000-0x00000000029A1000-memory.dmp
memory/3032-13-0x0000000002390000-0x0000000002391000-memory.dmp
memory/3032-8-0x0000000002400000-0x0000000002401000-memory.dmp
memory/3032-5-0x0000000002430000-0x0000000002431000-memory.dmp
memory/3032-1-0x00000000009D0000-0x0000000000A1B000-memory.dmp
memory/3032-7-0x0000000002940000-0x0000000002945000-memory.dmp
memory/3032-6-0x00000000023C0000-0x00000000023C1000-memory.dmp
memory/3728-1211-0x0000000000400000-0x0000000000525000-memory.dmp
memory/4692-608-0x0000000000400000-0x0000000000525000-memory.dmp
memory/4812-1333-0x0000000000400000-0x0000000000525000-memory.dmp
memory/4936-1499-0x0000000000400000-0x0000000000525000-memory.dmp
memory/4960-954-0x0000000000400000-0x0000000000525000-memory.dmp