Analysis

  • max time kernel
    105s
  • max time network
    113s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-09-2024 21:40

General

  • Target

    a8468a7b20ae59be91f54981f7ee4830N.exe

  • Size

    72KB

  • MD5

    a8468a7b20ae59be91f54981f7ee4830

  • SHA1

    0996f20131814bb0ac7fb081ef2ca5809b76d126

  • SHA256

    8de9c60fd8418db5f644efd5306d72723b828c54f5a973683606ffc249443106

  • SHA512

    957252fa640aa8611b466947118e4cbe25f9bdbe30f90d37ce7c8a90721f2f07c12441d619d5883d4a75e9399f7623c9f2a67286033f47b63f42dd69d44be82d

  • SSDEEP

    1536:IDcTKEq3tSF3m0+sLZC3O9w//m/OqDPMb+KR0Nc8QsJq39:WcTKDAL+KKG/OqDPe0Nc8QsC9

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a8468a7b20ae59be91f54981f7ee4830N.exe
    "C:\Users\Admin\AppData\Local\Temp\a8468a7b20ae59be91f54981f7ee4830N.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:3240

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3240-0-0x0000000000760000-0x0000000000761000-memory.dmp

    Filesize

    4KB