metasploit | a5832da88af02d18a19ced73509e983e030be06f88399076210a321b7660c233

Analysis

max time kernel
105s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 15:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a5832da88af02d18a19ced73509e983e030be06f88399076210a321b7660c233N.exe
Size

72KB
MD5

987dbb59d61bcd08615ee6ae6ccc2ba0
SHA1

d11d44f46caa5490243922dff3fd42951ac6530d
SHA256

a5832da88af02d18a19ced73509e983e030be06f88399076210a321b7660c233
SHA512

ef9602b87ba655b78f6f1452705d99201cfd9391c3868762e890d0df147dc6fb0c82c6e4ff9510702c5252a5f4ee384307ce9431e0e2c1f2009f9e35c8bb48d1
SSDEEP

1536:Is0rK9u96mEdWbabe3tp+tg8uYl/ihJTQfMb+KR0Nc8QsJq39:J0rv9gdWbaKtp+thvqTQfe0Nc8QsC9

Score

10^/10

metasploit backdoor discovery trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a5832da88af02d18a19ced73509e983e030be06f88399076210a321b7660c233N.exe

C:\Users\Admin\AppData\Local\Temp\a5832da88af02d18a19ced73509e983e030be06f88399076210a321b7660c233N.exe
"C:\Users\Admin\AppData\Local\Temp\a5832da88af02d18a19ced73509e983e030be06f88399076210a321b7660c233N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4368-0-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download