Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
27-04-2024 12:05
Behavioral task
behavioral1
Sample
ransome.exe
Resource
win7-20240215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
ransome.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
ransome.exe
-
Size
72KB
-
MD5
ead554ab48a2b43d1da4d624326817e4
-
SHA1
ae3b48adb79d12ea0c04757a6f7aa1435507688c
-
SHA256
981b41448dcf7983a1a961de23d64e61b66637febabff41f9c6956df81d88b5f
-
SHA512
30ebfef4c37dfedd19e0264bea3c4fd1e7955c0bb1305d5a04a2e815a5baf9fa843cbc56092b25908cf8019f20d22c85a1d1d08fb9991769d6e462eef9cae57e
-
SSDEEP
768:Ig8hjOwe5m+LeB37HnPGPvH1F1nNe3fwGmEIHuqa2gOWPCHSckzCScx4qXfb+KR9:IRjORJobGHjeJxz8MMb+KR0Nc8QsJq39
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
windows/reverse_tcp
C2
192.168.5.117:4444
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2908-0-0x0000000000020000-0x0000000000021000-memory.dmpFilesize
4KB