metasploit | d64ec0daa1364a5b8c079e1937286ee9a6a26912516cb644180da856f95e272a

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17-09-2024 02:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d64ec0daa1364a5b8c079e1937286ee9a6a26912516cb644180da856f95e272a.exe
Size

72KB
MD5

e34a75ce1f8605cdd3c2c9ab0ba342a2
SHA1

bf3b979aeb33a8e4f05a7cc4cc3fbf4d76cef0aa
SHA256

d64ec0daa1364a5b8c079e1937286ee9a6a26912516cb644180da856f95e272a
SHA512

8fc8f065de93908f5e05df51d17bdba593b48ccf0e3c33604bdb0ca8e2d74f14cfac48e4d2fd9aaafaf5fc125cac6d1479bffa66896c22608dbec29119a56ed4
SSDEEP

1536:I3OkwqwXrCm0MeA5Tdp6gYN/tfyWnW0Mb+KR0Nc8QsJq39:iOVqwbCmLx5b6gYJtfI0e0Nc8QsC9

Score

10^/10

metasploit backdoor discovery trojan

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

192.168.1.10:21345

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d64ec0daa1364a5b8c079e1937286ee9a6a26912516cb644180da856f95e272a.exe

C:\Users\Admin\AppData\Local\Temp\d64ec0daa1364a5b8c079e1937286ee9a6a26912516cb644180da856f95e272a.exe
"C:\Users\Admin\AppData\Local\Temp\d64ec0daa1364a5b8c079e1937286ee9a6a26912516cb644180da856f95e272a.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1488-0-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download