Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12/11/2024, 22:10

General

  • Target

    d0f7d71a887e550339e8cc0ff343900506894f9b80b904c3ec923069bc6fb1c2.exe

  • Size

    7KB

  • MD5

    f9034f24f09fd0e95ad12ad7e9d418c1

  • SHA1

    e0a229000d39c02ed25a9d137b73090c1dcb42b2

  • SHA256

    d0f7d71a887e550339e8cc0ff343900506894f9b80b904c3ec923069bc6fb1c2

  • SHA512

    2e62ecfb52521af8a788606813aa123ef8824a428a2fb3df24543648f8c0d462e9512c0db04e397d36557e1d0ad8d2626bbe744c1dfbf1738f129b5cb810be9f

  • SSDEEP

    24:eFGStrJ9u0/6e1xnZdkBQAVgWYRYKLqIeNDMSCvOXpmB/:is0T1BkBQzRYoSD9C2kB/

Malware Config

Extracted

Family

metasploit

Version

metasploit_stager

C2

10.0.2.5:7777

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Metasploit family

Processes

  • C:\Users\Admin\AppData\Local\Temp\d0f7d71a887e550339e8cc0ff343900506894f9b80b904c3ec923069bc6fb1c2.exe
    "C:\Users\Admin\AppData\Local\Temp\d0f7d71a887e550339e8cc0ff343900506894f9b80b904c3ec923069bc6fb1c2.exe"
    1⤵
      PID:2116

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2116-0-0x0000000140000000-0x0000000140004278-memory.dmp

      Filesize

      16KB

    • memory/2116-1-0x0000000140000000-0x0000000140004278-memory.dmp

      Filesize

      16KB