Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
26-09-2024 02:23
Behavioral task
behavioral1
Sample
ceef35f60b78a066fa9de635f92bd00eada3e52811ec10a0b84083829a99ec58.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ceef35f60b78a066fa9de635f92bd00eada3e52811ec10a0b84083829a99ec58.exe
Resource
win10v2004-20240802-en
General
-
Target
ceef35f60b78a066fa9de635f92bd00eada3e52811ec10a0b84083829a99ec58.exe
-
Size
72KB
-
MD5
9bd1fcf69167e197386c0ba2f84cddf5
-
SHA1
b23c03bc4646d2175ef9c3d0ee7d8c52daba6a73
-
SHA256
ceef35f60b78a066fa9de635f92bd00eada3e52811ec10a0b84083829a99ec58
-
SHA512
aec052c78a456ede59aae59463926018982effc4c309f56d7b184e85b433c19429f2f594d02cad0472e43f96719cd7e6bc3dae20e2d625e50f3dba5339b5cbb0
-
SSDEEP
1536:Ikpz0d1RN98WDIa+wMUMb+KR0Nc8QsJq39:hpzy1yWDzte0Nc8QsC9
Malware Config
Extracted
metasploit
encoder/shikata_ga_nai
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ceef35f60b78a066fa9de635f92bd00eada3e52811ec10a0b84083829a99ec58.exe
Processes
Network
-
Remote address:8.8.8.8:53Request28.118.140.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request240.221.184.93.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request23.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request154.239.44.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request26.165.165.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request98.117.19.2.in-addr.arpaIN PTRResponse98.117.19.2.in-addr.arpaIN PTRa2-19-117-98deploystaticakamaitechnologiescom
-
72 B 158 B 1 1
DNS Request
28.118.140.52.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
23.159.190.20.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
240.221.184.93.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
154.239.44.20.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
26.165.165.52.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
171.39.242.20.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
98.117.19.2.in-addr.arpa