Analysis
-
max time kernel
119s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 19:28
Static task
static1
Behavioral task
behavioral1
Sample
0d4f74a9d8981a84c01cf2d347da92f5b37e6efc8c80f1e9ee3f62429b96bc35.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0d4f74a9d8981a84c01cf2d347da92f5b37e6efc8c80f1e9ee3f62429b96bc35.exe
Resource
win10v2004-20241007-en
General
-
Target
0d4f74a9d8981a84c01cf2d347da92f5b37e6efc8c80f1e9ee3f62429b96bc35.exe
-
Size
102KB
-
MD5
187193173cb7ee09e0cfa9becc45b84d
-
SHA1
5d53f45189b31f4844f805e9cf05a70d1a65dccb
-
SHA256
0d4f74a9d8981a84c01cf2d347da92f5b37e6efc8c80f1e9ee3f62429b96bc35
-
SHA512
58bf20ff52f7ef611b37078416954e4871b91387037aac2e15e43f0b070005c4fb538cc604dd364a04c8f8471d4e3e14c6e02550160d8f661b7ae086391616c6
-
SSDEEP
3072:ndcctiF5ohmtJ9AfmluAvYglbol9KYjW3nhWqXPhpWtp7FDiKg:n+A85umtJU0bq9KY63nvXPhpWtp7FeH
Malware Config
Extracted
metasploit
windows/reverse_tcp
217.182.208.93:4770
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Executes dropped EXE 1 IoCs
pid Process 2828 0d4f74a9d8981a84c01cf2d347da92f5b37e6efc8c80f1e9ee3f62429b96bc35.exe -
Loads dropped DLL 1 IoCs
pid Process 2984 0d4f74a9d8981a84c01cf2d347da92f5b37e6efc8c80f1e9ee3f62429b96bc35.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2984 set thread context of 2828 2984 0d4f74a9d8981a84c01cf2d347da92f5b37e6efc8c80f1e9ee3f62429b96bc35.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0d4f74a9d8981a84c01cf2d347da92f5b37e6efc8c80f1e9ee3f62429b96bc35.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0d4f74a9d8981a84c01cf2d347da92f5b37e6efc8c80f1e9ee3f62429b96bc35.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2736 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2984 0d4f74a9d8981a84c01cf2d347da92f5b37e6efc8c80f1e9ee3f62429b96bc35.exe 2984 0d4f74a9d8981a84c01cf2d347da92f5b37e6efc8c80f1e9ee3f62429b96bc35.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2984 0d4f74a9d8981a84c01cf2d347da92f5b37e6efc8c80f1e9ee3f62429b96bc35.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2984 wrote to memory of 2736 2984 0d4f74a9d8981a84c01cf2d347da92f5b37e6efc8c80f1e9ee3f62429b96bc35.exe 30 PID 2984 wrote to memory of 2736 2984 0d4f74a9d8981a84c01cf2d347da92f5b37e6efc8c80f1e9ee3f62429b96bc35.exe 30 PID 2984 wrote to memory of 2736 2984 0d4f74a9d8981a84c01cf2d347da92f5b37e6efc8c80f1e9ee3f62429b96bc35.exe 30 PID 2984 wrote to memory of 2736 2984 0d4f74a9d8981a84c01cf2d347da92f5b37e6efc8c80f1e9ee3f62429b96bc35.exe 30 PID 2984 wrote to memory of 2828 2984 0d4f74a9d8981a84c01cf2d347da92f5b37e6efc8c80f1e9ee3f62429b96bc35.exe 32 PID 2984 wrote to memory of 2828 2984 0d4f74a9d8981a84c01cf2d347da92f5b37e6efc8c80f1e9ee3f62429b96bc35.exe 32 PID 2984 wrote to memory of 2828 2984 0d4f74a9d8981a84c01cf2d347da92f5b37e6efc8c80f1e9ee3f62429b96bc35.exe 32 PID 2984 wrote to memory of 2828 2984 0d4f74a9d8981a84c01cf2d347da92f5b37e6efc8c80f1e9ee3f62429b96bc35.exe 32 PID 2984 wrote to memory of 2828 2984 0d4f74a9d8981a84c01cf2d347da92f5b37e6efc8c80f1e9ee3f62429b96bc35.exe 32 PID 2984 wrote to memory of 2828 2984 0d4f74a9d8981a84c01cf2d347da92f5b37e6efc8c80f1e9ee3f62429b96bc35.exe 32 PID 2984 wrote to memory of 2828 2984 0d4f74a9d8981a84c01cf2d347da92f5b37e6efc8c80f1e9ee3f62429b96bc35.exe 32 PID 2984 wrote to memory of 2828 2984 0d4f74a9d8981a84c01cf2d347da92f5b37e6efc8c80f1e9ee3f62429b96bc35.exe 32 PID 2984 wrote to memory of 2828 2984 0d4f74a9d8981a84c01cf2d347da92f5b37e6efc8c80f1e9ee3f62429b96bc35.exe 32 PID 2984 wrote to memory of 2828 2984 0d4f74a9d8981a84c01cf2d347da92f5b37e6efc8c80f1e9ee3f62429b96bc35.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d4f74a9d8981a84c01cf2d347da92f5b37e6efc8c80f1e9ee3f62429b96bc35.exe"C:\Users\Admin\AppData\Local\Temp\0d4f74a9d8981a84c01cf2d347da92f5b37e6efc8c80f1e9ee3f62429b96bc35.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Update\rdpclips" /XML "C:\Users\Admin\AppData\Local\Temp\z227"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2736
-
-
C:\Users\Admin\AppData\Local\Temp\0d4f74a9d8981a84c01cf2d347da92f5b37e6efc8c80f1e9ee3f62429b96bc35.exe"C:\Users\Admin\AppData\Local\Temp\0d4f74a9d8981a84c01cf2d347da92f5b37e6efc8c80f1e9ee3f62429b96bc35.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2828
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5cadf291502b9b09a2c50133bde762939
SHA1c0473e6cb738faf76ec8c25537d5388ba158ab2e
SHA2564dc7e86f80b728afcac5acde95ae114fe3077230e43f60eac6defbdf992fe303
SHA5122d462b138d61a45db0bdb1513a4bdcfccfe3a40f94d70b0c5d6db2d641130485db5bac685ed3a4ca3c622f3f9b634fc6919ffe56763113d1d097a168efc09725
-
\Users\Admin\AppData\Local\Temp\0d4f74a9d8981a84c01cf2d347da92f5b37e6efc8c80f1e9ee3f62429b96bc35.exe
Filesize102KB
MD5187193173cb7ee09e0cfa9becc45b84d
SHA15d53f45189b31f4844f805e9cf05a70d1a65dccb
SHA2560d4f74a9d8981a84c01cf2d347da92f5b37e6efc8c80f1e9ee3f62429b96bc35
SHA51258bf20ff52f7ef611b37078416954e4871b91387037aac2e15e43f0b070005c4fb538cc604dd364a04c8f8471d4e3e14c6e02550160d8f661b7ae086391616c6