Analysis

  • max time kernel
    115s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    20-09-2024 06:21

General

  • Target

    835866bd1d592338e7b977a3e09cf88bb798999808f5ac6f5b52162218b5df65N.exe

  • Size

    72KB

  • MD5

    816f776996f13ce86e69fc6567047010

  • SHA1

    583101a78192581b7ea95325924b8f2ce24637e3

  • SHA256

    835866bd1d592338e7b977a3e09cf88bb798999808f5ac6f5b52162218b5df65

  • SHA512

    35000be3f75dbeed5b87c63e281e2730cf816c55c82e5bc058cf6557c9e0615600bc391ed11ca3a4da826321e6c9c0f70081a2ad8cdd3805e0e872483c0512fd

  • SSDEEP

    1536:IMaVJE2/2HoMt0J3LVQT4pyHN46uKL0HJqMb+KR0Nc8QsJq39:V07s4J3tcNNL0we0Nc8QsC9

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\835866bd1d592338e7b977a3e09cf88bb798999808f5ac6f5b52162218b5df65N.exe
    "C:\Users\Admin\AppData\Local\Temp\835866bd1d592338e7b977a3e09cf88bb798999808f5ac6f5b52162218b5df65N.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2412

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2412-0-0x0000000000020000-0x0000000000021000-memory.dmp

    Filesize

    4KB