Analysis
- max time kernel
143s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
26/01/2024, 07:36
General
- Target 76c48291ff7f60cd3469ab31c2e0cc9b.exe
- Size 878KB
- Sample240126-jfmbgaacbj
- SHA256 c1aa411b6072dc54261a407818b0fdcbe2fd5173d9456811297339d47ec0f5de
Malware Config
Extracted
-
metasploit
-
encoder/call4_dword_xor
Signatures
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Drops file in Drivers directory 2 IoCs
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes
-
C:\Users\Admin\AppData\Local\Temp\76c48291ff7f60cd3469ab31c2e0cc9b.exe"C:\Users\Admin\AppData\Local\Temp\76c48291ff7f60cd3469ab31c2e0cc9b.exe"1⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Identifies Wine through registry keys
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2480-0-0x0000000000400000-0x000000000065F000-memory.dmp
memory/2480-4-0x0000000004870000-0x0000000004871000-memory.dmp
memory/2480-3-0x0000000004900000-0x0000000004901000-memory.dmp
memory/2480-2-0x0000000004860000-0x0000000004862000-memory.dmp
memory/2480-1-0x0000000000400000-0x000000000065F000-memory.dmp
memory/2480-10-0x0000000000400000-0x000000000065F000-memory.dmp
memory/2480-9-0x0000000004850000-0x0000000004851000-memory.dmp
memory/2480-8-0x0000000004910000-0x0000000004911000-memory.dmp
memory/2480-7-0x0000000004890000-0x0000000004891000-memory.dmp