Analysis

  • max time kernel
    105s
  • max time network
    113s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-09-2024 00:44

General

  • Target

    Trojan.Win64.Meterpreter.exe

  • Size

    7KB

  • MD5

    b4a899b8f62fa487920635266b7bb620

  • SHA1

    8e1e4c5a7276b18d16b6f588144b4ceb60acc509

  • SHA256

    002128e812585cea9afefc4448df8c661aa439a6dc634655e2e3a1f5ce574958

  • SHA512

    2fa92f239c59ff47c09532021a16e41b2e6d3f6467249dfc6fe1a453055c0c8306614dd9a0cc16f62584bb1211892d2772cf65589a059c9c478f7eed455916c6

  • SSDEEP

    24:eFGStrJ9u0/6fKmHnZdkBQAVKG1YLYKLq4deNDMSCvOXpmB:is07mjkBQvGqLYYdSD9C2kB

Malware Config

Extracted

Family

metasploit

Version

metasploit_stager

C2

192.168.93.129:8888

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Trojan.Win64.Meterpreter.exe
    "C:\Users\Admin\AppData\Local\Temp\Trojan.Win64.Meterpreter.exe"
    1⤵
      PID:512

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/512-0-0x0000000140000000-0x0000000140004278-memory.dmp

      Filesize

      16KB

    • memory/512-1-0x0000000140000000-0x0000000140004278-memory.dmp

      Filesize

      16KB