Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
15-04-2024 22:41
General
-
Target
tmp.exe
-
Size
31KB
-
MD5
e9dc029457e9d23c8db988c4c0585bfa
-
SHA1
3d670aa59c97d831e5097b69734b994bf4144cbb
-
SHA256
18ba6cd59749904247bade4b75429e2ac2c4ee2a6fe206ebd114e89283f8f5db
-
SHA512
3a6138fd199b3cd0a12f4a1ca193823b32afa557a3d7af5e279cc96edb3fcab31fcf6bbff357d089331f47a295e83222f17a45be3dd4254de88b06bf98f379a9
-
SSDEEP
192:+np66k5gQDVAU3l6+eKdv3Zn4TJrJfsQ5XfDcyLwaBg1+Cfs2LzwYDK7UlVSq7j4:GO/5AwJtZ4RFskLt
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
metasploit_stager
C2
124.221.70.199:8983
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1268-0-0x0000000002200000-0x0000000002201000-memory.dmpFilesize
4KB
-
memory/1268-1-0x0000000002200000-0x0000000002201000-memory.dmpFilesize
4KB
-
memory/1268-2-0x0000000002200000-0x0000000002201000-memory.dmpFilesize
4KB