General

  • Target

    6c2725ad714dd53321839db0c7cba9cf

  • Size

    173KB

  • Sample

    240121-c8ghcsdfc4

  • MD5

    6c2725ad714dd53321839db0c7cba9cf

  • SHA1

    393fd1b112b6213cd9698a3fbd70d1c0f336ff20

  • SHA256

    8dc7fc8c28112cbd24b3e3388ee9a01c9bbfcda058228fdb045c3633b16a7ebd

  • SHA512

    596977663fda3a36d407e1df5de0c1e8e4f6735b1e14f7fe6eae9afda94f0232b7af082c41c1a4faa9de3744dcf463d044a0270796e0ab4e8985ee6243e681fe

  • SSDEEP

    3072:SH2b9aw1ILnUHF+OqX575W4hxBDbCIQLhUsSpBJ5QhNwlUASCq+CYOC6Xce4:S2Raw1YUHsOqXF5d1CIQLhBSpBJq0WAx

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Targets

    • Target

      6c2725ad714dd53321839db0c7cba9cf

    • Size

      173KB

    • MD5

      6c2725ad714dd53321839db0c7cba9cf

    • SHA1

      393fd1b112b6213cd9698a3fbd70d1c0f336ff20

    • SHA256

      8dc7fc8c28112cbd24b3e3388ee9a01c9bbfcda058228fdb045c3633b16a7ebd

    • SHA512

      596977663fda3a36d407e1df5de0c1e8e4f6735b1e14f7fe6eae9afda94f0232b7af082c41c1a4faa9de3744dcf463d044a0270796e0ab4e8985ee6243e681fe

    • SSDEEP

      3072:SH2b9aw1ILnUHF+OqX575W4hxBDbCIQLhUsSpBJ5QhNwlUASCq+CYOC6Xce4:S2Raw1YUHsOqXF5d1CIQLhBSpBJq0WAx

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks