Analysis

  • max time kernel
    140s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-12-2024 20:06

General

  • Target

    svchost.exe

  • Size

    17KB

  • MD5

    a2de68a2f41e67db9a7acc4f499e7408

  • SHA1

    919c6474c6f8897677e9bd68e2f7d7c082a3e8f9

  • SHA256

    d4a0ab9a7174e5d01f4d0b741d2175a0fe9b489ef26792ae79c80fded9e49740

  • SHA512

    a1b36235ef3bffbb4e77a87ca38b463cc070e2f5cefb0834dfdf9b49256f5f00829ca7a5335147c64bd84d15cf2cfa87c9e2a868023d35e9c744f2a182f7fe6e

  • SSDEEP

    192:PXRi1E9psGBuYWqgePAz7vd5joQDZLZuFoUprzoU1gA8r66em8tfYZ1nijXh:vjpkn/eoz7vd6QDmFV3g3CfY3Ih

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Metasploit family

Processes

  • C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    1⤵
      PID:544

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/544-1-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-63-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-62-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-61-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-60-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-59-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-58-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-57-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-56-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-55-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-54-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-53-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-52-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-51-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-50-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-49-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-48-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-47-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-46-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-45-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-44-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-43-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-42-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-41-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-40-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-39-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-38-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-37-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-36-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-35-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-34-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-33-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-32-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-31-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-30-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-29-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-28-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-27-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-26-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-25-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-24-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-23-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-22-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-21-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-20-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-19-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-18-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-17-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-16-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-15-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-14-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-13-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-12-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-11-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-10-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-6-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-5-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-4-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-3-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-2-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-0-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/544-615-0x00000000034E0000-0x00000000038E0000-memory.dmp

      Filesize

      4.0MB

    • memory/544-616-0x0000000000780000-0x00000000007BA000-memory.dmp

      Filesize

      232KB

    • memory/544-627-0x0000000003A00000-0x0000000003C00000-memory.dmp

      Filesize

      2.0MB

    • memory/544-628-0x0000000003C00000-0x0000000003C6C000-memory.dmp

      Filesize

      432KB

    • memory/544-645-0x0000000003C70000-0x0000000003C96000-memory.dmp

      Filesize

      152KB

    • memory/544-644-0x0000000003A00000-0x0000000003C00000-memory.dmp

      Filesize

      2.0MB

    • memory/544-646-0x00000000034E0000-0x00000000038E0000-memory.dmp

      Filesize

      4.0MB

    • memory/544-649-0x0000000000780000-0x00000000007BA000-memory.dmp

      Filesize

      232KB

    • memory/544-650-0x0000000003A00000-0x0000000003C00000-memory.dmp

      Filesize

      2.0MB

    • memory/544-651-0x0000000003C00000-0x0000000003C6C000-memory.dmp

      Filesize

      432KB

    • memory/544-652-0x0000000003A00000-0x0000000003C00000-memory.dmp

      Filesize

      2.0MB

    • memory/544-653-0x0000000003C70000-0x0000000003C96000-memory.dmp

      Filesize

      152KB