Analysis
- max time kernel
120s - max time network
124s - platform
windows7_x64 - resource
win7-20240611-en - resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system - submitted
04/07/2024, 06:38
Behavioral task
behavioral1
Sample
d5f8785aedca631c7c8e123dc0e6e35f.dll
Resource
win7-20240611-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
d5f8785aedca631c7c8e123dc0e6e35f.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target d5f8785aedca631c7c8e123dc0e6e35f.dll
- Size 8KB
- Sample240704-hd2spsyfkn
- SHA256 f83bee2e9d7c8ead88c3d0b761339bfa232e14803608a17e60582516e6559ae0
- MD5 d5f8785aedca631c7c8e123dc0e6e35f
- SHA1 b1e6ad90352e7d170f3f2d7f3dba3691b8ac9884
- SHA512 06a9cb9d0690836b8767d848384cc2a994e65da13404a354220e0f7683821babb6647a848a0a5a49cc528721bb1ffcba9d51eae3b5ef9feceeb5ca6e631ed842
- SSDEEP 48:qUr3zU9G4aNVhnX5hthMt6dO28xZMEvCHPAPb:+DIibzs
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
metasploit
Version
-
windows/reverse_http
C2
-
http://89.197.154.116:7810/r0YP8_HZj6Xh9eD0h471LAg3P8LpTQjBwuoVU2_qOmLbrRhD7dzVzwh4X1zqWkGpdfKoeGcDyWqM5Vj7W_USDDh
Signatures
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Blocklisted process makes network request 20 IoCs
flow pid Process 3 2200 rundll32.exe 5 2200 rundll32.exe 6 2200 rundll32.exe 7 2200 rundll32.exe 8 2200 rundll32.exe 9 2200 rundll32.exe 11 2200 rundll32.exe 12 2200 rundll32.exe 13 2200 rundll32.exe 14 2200 rundll32.exe 15 2200 rundll32.exe 16 2200 rundll32.exe 18 2200 rundll32.exe 19 2200 rundll32.exe 20 2200 rundll32.exe 21 2200 rundll32.exe 22 2200 rundll32.exe 23 2200 rundll32.exe 25 2200 rundll32.exe 26 2200 rundll32.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1948 set thread context of 2200 1948 rundll32.exe 29 - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1704 wrote to memory of 1948 1704 rundll32.exe 28 PID 1704 wrote to memory of 1948 1704 rundll32.exe 28 PID 1704 wrote to memory of 1948 1704 rundll32.exe 28 PID 1704 wrote to memory of 1948 1704 rundll32.exe 28 PID 1704 wrote to memory of 1948 1704 rundll32.exe 28 PID 1704 wrote to memory of 1948 1704 rundll32.exe 28 PID 1704 wrote to memory of 1948 1704 rundll32.exe 28 PID 1948 wrote to memory of 2200 1948 rundll32.exe 29 PID 1948 wrote to memory of 2200 1948 rundll32.exe 29 PID 1948 wrote to memory of 2200 1948 rundll32.exe 29 PID 1948 wrote to memory of 2200 1948 rundll32.exe 29 PID 1948 wrote to memory of 2200 1948 rundll32.exe 29 PID 1948 wrote to memory of 2200 1948 rundll32.exe 29 PID 1948 wrote to memory of 2200 1948 rundll32.exe 29 PID 1948 wrote to memory of 2200 1948 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d5f8785aedca631c7c8e123dc0e6e35f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d5f8785aedca631c7c8e123dc0e6e35f.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe3⤵
- Blocklisted process makes network request
PID:2200
-
-