Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02-06-2024 10:30
Static task
static1
Behavioral task
behavioral1
Sample
45466bb8c9df944bbe1ec77042ccb91a7ab7ec7005529f6635e90adc81885b51.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
45466bb8c9df944bbe1ec77042ccb91a7ab7ec7005529f6635e90adc81885b51.exe
Resource
win10v2004-20240426-en
General
-
Target
45466bb8c9df944bbe1ec77042ccb91a7ab7ec7005529f6635e90adc81885b51.exe
-
Size
2.2MB
-
MD5
39062ba16d612942231798a0ff8db57a
-
SHA1
a89b784332c2bb17225fbd5f24de03e0374a53f0
-
SHA256
45466bb8c9df944bbe1ec77042ccb91a7ab7ec7005529f6635e90adc81885b51
-
SHA512
37573b5fd066b98f7ff636288360fa57e5db0601f4c789ba3ed7e5ae6af22013329477a196e61b805e4a40f190e8cf59f9bb20cc3b268cdcee30c1affff12aa5
-
SSDEEP
24576:U26SqYbeJa/R1GHjYDwZzlRogkvgaV6DPRaTGMQvYpH/airgJQdXwUZyT:TqbJuR1WjS2rXacRi8oai0Jmw0
Malware Config
Extracted
metasploit
windows/download_exec
http://101.43.128.61:59871/api/v2/1/getinfo
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
45466bb8c9df944bbe1ec77042ccb91a7ab7ec7005529f6635e90adc81885b51.exedescription pid process target process PID 2144 wrote to memory of 2248 2144 45466bb8c9df944bbe1ec77042ccb91a7ab7ec7005529f6635e90adc81885b51.exe notepad.exe PID 2144 wrote to memory of 2248 2144 45466bb8c9df944bbe1ec77042ccb91a7ab7ec7005529f6635e90adc81885b51.exe notepad.exe PID 2144 wrote to memory of 2248 2144 45466bb8c9df944bbe1ec77042ccb91a7ab7ec7005529f6635e90adc81885b51.exe notepad.exe PID 2144 wrote to memory of 2248 2144 45466bb8c9df944bbe1ec77042ccb91a7ab7ec7005529f6635e90adc81885b51.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\45466bb8c9df944bbe1ec77042ccb91a7ab7ec7005529f6635e90adc81885b51.exe"C:\Users\Admin\AppData\Local\Temp\45466bb8c9df944bbe1ec77042ccb91a7ab7ec7005529f6635e90adc81885b51.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2248-0-0x00000288F8720000-0x00000288F8721000-memory.dmpFilesize
4KB