metasploit | be054e7697abb5a3015335b4a3fcca7943d136fcab2a5c7ab14c6de7b1fe2d3d

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
05-11-2024 12:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be054e7697abb5a3015335b4a3fcca7943d136fcab2a5c7ab14c6de7b1fe2d3dN.exe
Size

72KB
MD5

e9f806b1f5df7662866cf6a86fea8000
SHA1

09ca7e31aaf2de8d9b31a60d0f058b547523cd3f
SHA256

be054e7697abb5a3015335b4a3fcca7943d136fcab2a5c7ab14c6de7b1fe2d3d
SHA512

ea5dbc1b61f1e5ea75d7c2254ee145a5193f0f21ac328a0a5c45d5e56a6684feba9282810ac58c533829cc00b0627210a3d611355fba7d40506722fa9f4bbacd
SSDEEP

1536:IA1eINykjxSjXeAmirHABRaGv6Mb+KR0Nc8QsJq39:FIsyixSjOAdABRMe0Nc8QsC9

Score

10^/10

metasploit backdoor discovery trojan

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

3.69.157.220:12829

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

be054e7697abb5a3015335b4a3fcca7943d136fcab2a5c7ab14c6de7b1fe2d3dN.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be054e7697abb5a3015335b4a3fcca7943d136fcab2a5c7ab14c6de7b1fe2d3dN.exe

C:\Users\Admin\AppData\Local\Temp\be054e7697abb5a3015335b4a3fcca7943d136fcab2a5c7ab14c6de7b1fe2d3dN.exe
"C:\Users\Admin\AppData\Local\Temp\be054e7697abb5a3015335b4a3fcca7943d136fcab2a5c7ab14c6de7b1fe2d3dN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2804-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download