Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
16/01/2024, 05:30
Static task
static1
Behavioral task
behavioral1
Sample
5f1473e25fc747345b429562f04a1dd7.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
5f1473e25fc747345b429562f04a1dd7.exe
Resource
win10v2004-20231215-en
General
-
Target
5f1473e25fc747345b429562f04a1dd7.exe
-
Size
89KB
-
MD5
5f1473e25fc747345b429562f04a1dd7
-
SHA1
40f4f42c880d4b90379f72960cce719fa50bb363
-
SHA256
bdc8387579c4b8b18eb4e4e7d0c8584799b5545193af74f7ed30fbba57fd924c
-
SHA512
dad6ddd6a92f9a450edf8d50ea2b067390d493b3bb3db056655200f58aca8f19d6e1b6e87a495dfa7e63b439b9a6673b5dfa244d436607b12baaba31c3ccc67b
-
SSDEEP
1536:dAskCL/AE/+Qrt8qfzLgdtsVJny/kd5eT3QNI4jTc6gL7qYORJupAJIma:dAs9LH/rrt8qfHgzsbtCgNRHc6gqzJul
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1840 set thread context of 4664 1840 5f1473e25fc747345b429562f04a1dd7.exe 88 PID 4664 set thread context of 2208 4664 5f1473e25fc747345b429562f04a1dd7.exe 93 -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1840 wrote to memory of 4664 1840 5f1473e25fc747345b429562f04a1dd7.exe 88 PID 1840 wrote to memory of 4664 1840 5f1473e25fc747345b429562f04a1dd7.exe 88 PID 1840 wrote to memory of 4664 1840 5f1473e25fc747345b429562f04a1dd7.exe 88 PID 1840 wrote to memory of 4664 1840 5f1473e25fc747345b429562f04a1dd7.exe 88 PID 1840 wrote to memory of 4664 1840 5f1473e25fc747345b429562f04a1dd7.exe 88 PID 1840 wrote to memory of 4664 1840 5f1473e25fc747345b429562f04a1dd7.exe 88 PID 1840 wrote to memory of 4664 1840 5f1473e25fc747345b429562f04a1dd7.exe 88 PID 1840 wrote to memory of 4664 1840 5f1473e25fc747345b429562f04a1dd7.exe 88 PID 1840 wrote to memory of 4664 1840 5f1473e25fc747345b429562f04a1dd7.exe 88 PID 1840 wrote to memory of 4664 1840 5f1473e25fc747345b429562f04a1dd7.exe 88 PID 1840 wrote to memory of 4664 1840 5f1473e25fc747345b429562f04a1dd7.exe 88 PID 1840 wrote to memory of 4664 1840 5f1473e25fc747345b429562f04a1dd7.exe 88 PID 1840 wrote to memory of 4664 1840 5f1473e25fc747345b429562f04a1dd7.exe 88 PID 4664 wrote to memory of 2208 4664 5f1473e25fc747345b429562f04a1dd7.exe 93 PID 4664 wrote to memory of 2208 4664 5f1473e25fc747345b429562f04a1dd7.exe 93 PID 4664 wrote to memory of 2208 4664 5f1473e25fc747345b429562f04a1dd7.exe 93 PID 4664 wrote to memory of 2208 4664 5f1473e25fc747345b429562f04a1dd7.exe 93 PID 4664 wrote to memory of 2208 4664 5f1473e25fc747345b429562f04a1dd7.exe 93 PID 4664 wrote to memory of 2208 4664 5f1473e25fc747345b429562f04a1dd7.exe 93 PID 4664 wrote to memory of 2208 4664 5f1473e25fc747345b429562f04a1dd7.exe 93 PID 4664 wrote to memory of 2208 4664 5f1473e25fc747345b429562f04a1dd7.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f1473e25fc747345b429562f04a1dd7.exe"C:\Users\Admin\AppData\Local\Temp\5f1473e25fc747345b429562f04a1dd7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\5f1473e25fc747345b429562f04a1dd7.exe"C:\Users\Admin\AppData\Local\Temp\5f1473e25fc747345b429562f04a1dd7.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\5f1473e25fc747345b429562f04a1dd7.exe"C:\Users\Admin\AppData\Local\Temp\5f1473e25fc747345b429562f04a1dd7.exe"3⤵PID:2208
-
-