Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
16/01/2024, 05:30
Static task
static1
Behavioral task
behavioral1
Sample
5f1473e25fc747345b429562f04a1dd7.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
5f1473e25fc747345b429562f04a1dd7.exe
Resource
win10v2004-20231215-en
General
-
Target
5f1473e25fc747345b429562f04a1dd7.exe
-
Size
89KB
-
MD5
5f1473e25fc747345b429562f04a1dd7
-
SHA1
40f4f42c880d4b90379f72960cce719fa50bb363
-
SHA256
bdc8387579c4b8b18eb4e4e7d0c8584799b5545193af74f7ed30fbba57fd924c
-
SHA512
dad6ddd6a92f9a450edf8d50ea2b067390d493b3bb3db056655200f58aca8f19d6e1b6e87a495dfa7e63b439b9a6673b5dfa244d436607b12baaba31c3ccc67b
-
SSDEEP
1536:dAskCL/AE/+Qrt8qfzLgdtsVJny/kd5eT3QNI4jTc6gL7qYORJupAJIma:dAs9LH/rrt8qfHgzsbtCgNRHc6gqzJul
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2888 set thread context of 2220 2888 5f1473e25fc747345b429562f04a1dd7.exe 28 PID 2220 set thread context of 2788 2220 5f1473e25fc747345b429562f04a1dd7.exe 29 -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2888 wrote to memory of 2220 2888 5f1473e25fc747345b429562f04a1dd7.exe 28 PID 2888 wrote to memory of 2220 2888 5f1473e25fc747345b429562f04a1dd7.exe 28 PID 2888 wrote to memory of 2220 2888 5f1473e25fc747345b429562f04a1dd7.exe 28 PID 2888 wrote to memory of 2220 2888 5f1473e25fc747345b429562f04a1dd7.exe 28 PID 2888 wrote to memory of 2220 2888 5f1473e25fc747345b429562f04a1dd7.exe 28 PID 2888 wrote to memory of 2220 2888 5f1473e25fc747345b429562f04a1dd7.exe 28 PID 2888 wrote to memory of 2220 2888 5f1473e25fc747345b429562f04a1dd7.exe 28 PID 2888 wrote to memory of 2220 2888 5f1473e25fc747345b429562f04a1dd7.exe 28 PID 2888 wrote to memory of 2220 2888 5f1473e25fc747345b429562f04a1dd7.exe 28 PID 2888 wrote to memory of 2220 2888 5f1473e25fc747345b429562f04a1dd7.exe 28 PID 2888 wrote to memory of 2220 2888 5f1473e25fc747345b429562f04a1dd7.exe 28 PID 2888 wrote to memory of 2220 2888 5f1473e25fc747345b429562f04a1dd7.exe 28 PID 2220 wrote to memory of 2788 2220 5f1473e25fc747345b429562f04a1dd7.exe 29 PID 2220 wrote to memory of 2788 2220 5f1473e25fc747345b429562f04a1dd7.exe 29 PID 2220 wrote to memory of 2788 2220 5f1473e25fc747345b429562f04a1dd7.exe 29 PID 2220 wrote to memory of 2788 2220 5f1473e25fc747345b429562f04a1dd7.exe 29 PID 2220 wrote to memory of 2788 2220 5f1473e25fc747345b429562f04a1dd7.exe 29 PID 2220 wrote to memory of 2788 2220 5f1473e25fc747345b429562f04a1dd7.exe 29 PID 2220 wrote to memory of 2788 2220 5f1473e25fc747345b429562f04a1dd7.exe 29 PID 2220 wrote to memory of 2788 2220 5f1473e25fc747345b429562f04a1dd7.exe 29 PID 2220 wrote to memory of 2788 2220 5f1473e25fc747345b429562f04a1dd7.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f1473e25fc747345b429562f04a1dd7.exe"C:\Users\Admin\AppData\Local\Temp\5f1473e25fc747345b429562f04a1dd7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\5f1473e25fc747345b429562f04a1dd7.exe"C:\Users\Admin\AppData\Local\Temp\5f1473e25fc747345b429562f04a1dd7.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\5f1473e25fc747345b429562f04a1dd7.exe"C:\Users\Admin\AppData\Local\Temp\5f1473e25fc747345b429562f04a1dd7.exe"3⤵PID:2788
-
-