Analysis
-
max time kernel
24s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-04-2024 15:29
Behavioral task
behavioral1
Sample
chinatown4.exe
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
chinatown4.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
chinatown4.exe
-
Size
62KB
-
MD5
904eceda3bc2cc9c4dc1f1817252e757
-
SHA1
2353b2dd7517c4d6050b5e4dbf92b034afedc99a
-
SHA256
75ea206a92a9831ad571d380625b46797d892cec266d10b16d7c18ce856ec1cd
-
SHA512
9965579b6d23f34fcbe8e1311f30b8eef537da4d87926c80b723b06d26c2ca21703c03a5c0fa29beaf440fb726805f728684098b169aa2ced00c972b9e5dc3b3
-
SSDEEP
384:5YKaOwjvSF3F5mjuCeTIu3yo7NMvSsI0FKhS3cbHC6f6NtQfBCPS829dUpKA89Xu:IOoumGyfenOczN6OBgPYdNA89
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
metasploit_stager
C2
185.113.8.148:8443
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
Processes
-
C:\Users\Admin\AppData\Local\Temp\chinatown4.exe"C:\Users\Admin\AppData\Local\Temp\chinatown4.exe"1⤵PID:2864
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵PID:2964
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵PID:2752