Analysis

  • max time kernel
    152s
  • max time network
    197s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/01/2024, 11:50

General

  • Target

    10c1800829353d71be7efd4a77b126e9.exe

  • Size

    734KB

  • MD5

    10c1800829353d71be7efd4a77b126e9

  • SHA1

    43ea3aa190ed7fdc9830314109b1c4c0f80c6b0d

  • SHA256

    6f915ed4cd98d06fa885bbe1477a85e96e09f95f70b2126760011a57cecf9bcc

  • SHA512

    5434966531d25f6a80d7f5dc3175f03f5e85e52d3a847d68a3dc51332cce55e51ce4449bd72f2ecdcfdfd269dd2c2aa5b5582ea5913ab5d740a9eec9a405542d

  • SSDEEP

    12288:UfKswKXh8VxdWr8/83arRueBYl7/lfh3P27ExwOm8YqdKoMCG:UiswswdWr08qrkVfh3P6ROm8n

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

C2

10.8.138.100:8080

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

Processes

  • C:\Users\Admin\AppData\Local\Temp\10c1800829353d71be7efd4a77b126e9.exe
    "C:\Users\Admin\AppData\Local\Temp\10c1800829353d71be7efd4a77b126e9.exe"
    1⤵
      PID:2848

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2848-1-0x0000000000660000-0x0000000000661000-memory.dmp

      Filesize

      4KB

    • memory/2848-0-0x0000000000660000-0x0000000000661000-memory.dmp

      Filesize

      4KB