Analysis
-
max time kernel
130s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
16-09-2024 21:52
General
-
Target
HEXEDIT MODIFY 3.exe
-
Size
72KB
-
MD5
c52ac954c3df952c8645e349de666b9b
-
SHA1
4eee13a561e6bc57a8d8d08814239a9c3123e93a
-
SHA256
4d5b6c817c50dd4100e83a0e8ff01df9f88fcceac813618dfabd8972c2a105fc
-
SHA512
bf641de0d94b352d57a97c87b4ec80574d8f6a64e1e943f38b647a712a6415ef9a39eca5bade342d4c34c69025719d00a9c5411375acdf6bdeb866c9b40b0659
-
SSDEEP
1536:Q1Ka6/nMXBakSrNs+yb2out2bXnjMb+KR0Nc8QsJq39:EK7/6aZy+yb2vAbXnje0Nc8QsC9
Malware Config
Extracted
metasploit
windows/reverse_http
http://192.168.77.128:8080/CUoHBEbCdNPMEc0Qqs84ygsRt3Aw0M7RRFrspeZzYCxQxM2xFsPDDxKdxfIIpeWiRgF-bauwEmuiIcWxbyuSgeJW88ItNnkjPyBaf6NNDMa4PlsqVLlsjcae2N4g1w69JGXP9sozVWGNKrgaeM1QoSKErOa4xsu6IWmp29vHsTj88n8
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\HEXEDIT MODIFY 3.exe"C:\Users\Admin\AppData\Local\Temp\HEXEDIT MODIFY 3.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB