metasploit | f378b21d115a503af5d49bc157ad868638d0a917a6945b5d72800e898a92d5a7

Analysis

max time kernel
111s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-09-2024 06:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f378b21d115a503af5d49bc157ad868638d0a917a6945b5d72800e898a92d5a7N.exe
Size

72KB
MD5

f1600653985d5f215e97b94de6774f80
SHA1

55ad42f43319cfdfa501e31a67f89f62e807fcad
SHA256

f378b21d115a503af5d49bc157ad868638d0a917a6945b5d72800e898a92d5a7
SHA512

a8d0c4c93c5277ea2645e925178a249b5dfab5d2903f942857c23e7838f1258950a97d7ab66a510491979b07934c688558e35546d8041bb2aac2999a0ba4c223
SSDEEP

1536:I1Uh3K2lQlcJfWcdS/BFkGFbzysfzsSLwPxDZ7FMb+KR0Nc8QsJq39:sUhXQcI6IqGDFwz5e0Nc8QsC9

Score

10^/10

metasploit backdoor discovery trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f378b21d115a503af5d49bc157ad868638d0a917a6945b5d72800e898a92d5a7N.exe

C:\Users\Admin\AppData\Local\Temp\f378b21d115a503af5d49bc157ad868638d0a917a6945b5d72800e898a92d5a7N.exe
"C:\Users\Admin\AppData\Local\Temp\f378b21d115a503af5d49bc157ad868638d0a917a6945b5d72800e898a92d5a7N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2728-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download