metasploit | 6c0c4149ccc65f6bb9628b4edb00744c5e30c1cdb0fa2e047a520106b76ddcb9

Analysis

max time kernel
105s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c0c4149ccc65f6bb9628b4edb00744c5e30c1cdb0fa2e047a520106b76ddcb9N.exe
Size

72KB
MD5

c00d0b1cbecccd2d4ff4ec8b4f819cd0
SHA1

42422dfa4b815d717df6c6ea3b7f19ad5696b9ae
SHA256

6c0c4149ccc65f6bb9628b4edb00744c5e30c1cdb0fa2e047a520106b76ddcb9
SHA512

c3744cf761b6380b533c5f0b08bc1ef31fb86675d639c66d2aa18046a31b66a092ef74a4262bc8a6bf350e8411bcaf96a296981dd7268023fb50527e970479c8
SSDEEP

1536:IOe6D1ILofDg73vuStVo06JzPpRk6Mb+KR0Nc8QsJq39:C6D1OofI/u2CzBle0Nc8QsC9

Score

10^/10

metasploit backdoor discovery trojan

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

192.168.93.129:4444

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

6c0c4149ccc65f6bb9628b4edb00744c5e30c1cdb0fa2e047a520106b76ddcb9N.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6c0c4149ccc65f6bb9628b4edb00744c5e30c1cdb0fa2e047a520106b76ddcb9N.exe

C:\Users\Admin\AppData\Local\Temp\6c0c4149ccc65f6bb9628b4edb00744c5e30c1cdb0fa2e047a520106b76ddcb9N.exe
"C:\Users\Admin\AppData\Local\Temp\6c0c4149ccc65f6bb9628b4edb00744c5e30c1cdb0fa2e047a520106b76ddcb9N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2436-0-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download