metasploit | 4f567bf4bdba4da6f49fffc64b5dfe1ae5023cdf146f4bdcf08041fe3f8372f5

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-09-2024 20:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f567bf4bdba4da6f49fffc64b5dfe1ae5023cdf146f4bdcf08041fe3f8372f5N.exe
Size

72KB
MD5

ec89500d1b49a7d3f84799a4561254b0
SHA1

4907a12c3a5408262c58c21787409ba21027ed05
SHA256

4f567bf4bdba4da6f49fffc64b5dfe1ae5023cdf146f4bdcf08041fe3f8372f5
SHA512

ff13c9a05824c1c15d948c6ba8369ca149b08d4f622e0a2164b370af781a3555b7fd2fec74662a280cc01956213113a14f5795b8c208c11b3e4bb4b2ea4271c0
SSDEEP

1536:IP9oEmoQx/ZS0aCUpqGF62kFJZtMb+KR0Nc8QsJq39:+rQx/M0aCbpJ/e0Nc8QsC9

Score

10^/10

metasploit backdoor discovery trojan

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

86.248.236.214:21526

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4f567bf4bdba4da6f49fffc64b5dfe1ae5023cdf146f4bdcf08041fe3f8372f5N.exe

C:\Users\Admin\AppData\Local\Temp\4f567bf4bdba4da6f49fffc64b5dfe1ae5023cdf146f4bdcf08041fe3f8372f5N.exe
"C:\Users\Admin\AppData\Local\Temp\4f567bf4bdba4da6f49fffc64b5dfe1ae5023cdf146f4bdcf08041fe3f8372f5N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2692-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download