Analysis

  • max time kernel
    59s
  • max time network
    63s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/01/2024, 23:59

General

  • Target

    TurtleSUSP-582404.exe

  • Size

    59KB

  • MD5

    546f78fc99629b5cb89dedcde491a12d

  • SHA1

    5824048c08bfd866f8a291c81e09378e9c85bffa

  • SHA256

    828dea851207fd91c8f1ce50c324ddad6034f602d18ba05f5792bbd7157dc509

  • SHA512

    b0a76f690a8d886defa2efd1d538e51e8038e22089340661647f5fc6394bc99d18e649bf839d95f781637d4f55e378dc3d9fd85bf462986bbae852056d7163e2

  • SSDEEP

    768:CwRgqiUXcWwAVDcfEqTIYv4gKNwFPcjr6nJSYpY28clIPE:CUdiycjEqTIm4gKN2PcjrFjx6d

Malware Config

Extracted

Family

metasploit

Version

metasploit_stager

C2

192.168.127.1:4444

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

Processes

  • C:\Users\Admin\AppData\Local\Temp\TurtleSUSP-582404.exe
    "C:\Users\Admin\AppData\Local\Temp\TurtleSUSP-582404.exe"
    1⤵
      PID:3596

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3596-0-0x00007FFF89F10000-0x00007FFF8A105000-memory.dmp

      Filesize

      2.0MB

    • memory/3596-1-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

    • memory/3596-2-0x0000000000400000-0x0000000000413000-memory.dmp

      Filesize

      76KB