Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
29-04-2024 13:14
Static task
static1
Behavioral task
behavioral1
Sample
8e4acd2999b08e34952c29af8ab310085cda9fbe59b0e8bcc5b85e8af5af455c.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
8e4acd2999b08e34952c29af8ab310085cda9fbe59b0e8bcc5b85e8af5af455c.exe
Resource
win10v2004-20240226-en
General
-
Target
8e4acd2999b08e34952c29af8ab310085cda9fbe59b0e8bcc5b85e8af5af455c.exe
-
Size
890KB
-
MD5
1d1b817a91e8548400cfbc9da4b1b4da
-
SHA1
2556e64234a4eed97166185cd66ee74a244b6b5d
-
SHA256
8e4acd2999b08e34952c29af8ab310085cda9fbe59b0e8bcc5b85e8af5af455c
-
SHA512
2150f87809a5e083e18cdb7894fcacc33ff6241e1045e10bc57dfb2d88066f5a606ca392023f9a875f2f214383a26f1bc667bea56741b0f41d68d5ff87736afd
-
SSDEEP
24576:xFZu3sEGb/iPkbBFg/cwbzsUZJ7NW4Ceog:xF3XbBFKZbzDZJ7NPo
Malware Config
Extracted
metasploit
windows/shell_reverse_tcp
127.0.0.1:4444
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Suspicious behavior: LoadsDriver 64 IoCs
Processes:
pid process 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476 476
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ALSysIO64.sysFilesize
42KB
MD5d9aafc513be1c4c57b9f9827e986039c
SHA12c688a6e881d35df958cb8ff2e2bd8e21b8461bc
SHA2567a20ca8f9361eb892257b3693095ffeee61457dc4e22d9b119e3a9f3a1507069
SHA512200a3df1ad0a18f5547e2f595f412f96d76040fa16de4720f76b305178a2bf9c944d31b5928dc2333d99a72fd617762e87885aa7e56719ccba2e7e593450f6fd
-
C:\Users\Admin\AppData\Local\Temp\CoreTemp.iniFilesize
1KB
MD594b56e0809f8b30af3aaae2a68f498b3
SHA1a37a100fe91c0d9731f325994778d7c7c033451c
SHA25623f972f8ab3952b2f891a41bd2d151d97016ca7bc9c78df30b1ab376211c66ec
SHA51299f7142431b98bb09eb57db3437c0fa0ee75817de9c24eb294ce53ff1cd526d96ddf8c3d12d8ed524d9676cc90098c7565004468d205e9cd0d06aaa52c748ca0
-
memory/2396-0-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2396-11-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB