Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-09-2024 18:30
General
-
Target
1bdc650856d0cd7f21f0592eb70f67747f9ddea4c09e91118ae6c4d59c07f992.exe
-
Size
274KB
-
MD5
76aa650928178afd3cfeabc23b8b4074
-
SHA1
c08297db120619ddcbaa3edc994f733c13ea5b85
-
SHA256
1bdc650856d0cd7f21f0592eb70f67747f9ddea4c09e91118ae6c4d59c07f992
-
SHA512
2a9233800ca1996c4ad2084ca59eb65ad0231e19e028d8c5d65ea99dd99d67d13ee6d91b3a5b67427a3c200cb269fcd5c939d72787f1bad89ed7af6bddf5a89f
-
SSDEEP
3072:UYRo4BWQ+bJ55IUpzqm1r8J+g2RJY9bC+KRZE6JNlhbxW9u3:UYAJ55IUpORx2LxtE6VhbxWk
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
metasploit_stager
C2
192.168.110.138:8080
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bdc650856d0cd7f21f0592eb70f67747f9ddea4c09e91118ae6c4d59c07f992.exe"C:\Users\Admin\AppData\Local\Temp\1bdc650856d0cd7f21f0592eb70f67747f9ddea4c09e91118ae6c4d59c07f992.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wpr.exeC:\Windows\System32\wpr.exe2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
4KB