Analysis

  • max time kernel
    139s
  • max time network
    100s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240910-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-09-2024 13:55

General

  • Target

    b17852271e6713aa798349385722aa8d297c9fbcfc6b1ee5cab08c17808e4773.exe

  • Size

    205KB

  • MD5

    0ef6dd35893bcf09f79bde99945e433d

  • SHA1

    b9a36c4c136f6b184233c2877265c3822b8929ef

  • SHA256

    b17852271e6713aa798349385722aa8d297c9fbcfc6b1ee5cab08c17808e4773

  • SHA512

    4c38c3150638322c0ff8b593378728c32e465543993003b7a3f93c0eb14100ab9251de2157f35f7a80b5ddfeb67e5c7ac19b3688c2f913c0dd56c02e1000d117

  • SSDEEP

    3072:diWl9Wspep60ffglW3AIJPeV469ZEn3fazaGiNPRJQ6ybSMhkkBdGNIke313wP8:dZl9WspetYUAIm46Y3lGgofb/UI1w

Malware Config

Extracted

Family

metasploit

Version

metasploit_stager

C2

192.168.223.128:8443

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b17852271e6713aa798349385722aa8d297c9fbcfc6b1ee5cab08c17808e4773.exe
    "C:\Users\Admin\AppData\Local\Temp\b17852271e6713aa798349385722aa8d297c9fbcfc6b1ee5cab08c17808e4773.exe"
    1⤵
      PID:684

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/684-0-0x0000022818800000-0x0000022818801000-memory.dmp

      Filesize

      4KB