Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 18:36
General
-
Target
845ffd23eb77a7d448104ca77f78435ab18c11a57c664539f1842107d698d44f.exe
-
Size
6.0MB
-
MD5
426500a7a9e8f0585dc91ffc9131fcf8
-
SHA1
8dcaf0975c5406b1e55b9f289c0a9c06cc86149d
-
SHA256
845ffd23eb77a7d448104ca77f78435ab18c11a57c664539f1842107d698d44f
-
SHA512
7c2cc298d7ae1c1c133e3ed48b60649c4c0e101c738f7f75b320dc171d04f910edaa4d5b9307fe1e6943311ff1dc158700f8596555b827ee6a1f404fe71fb4a5
-
SSDEEP
98304:2niwsdzb/SQ370L9ZIRZO7LVzVUiypZwswW9o6Ax7QEWnuULQ4k8rZuuwUyq:25sJ2VBi76LVzVfiRhGArkWuuwUyq
Malware Config
Extracted
metasploit
windows/shell_reverse_tcp
192.168.253.128:9000
Extracted
metasploit
encoder/shikata_ga_nai
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\845ffd23eb77a7d448104ca77f78435ab18c11a57c664539f1842107d698d44f.exe"C:\Users\Admin\AppData\Local\Temp\845ffd23eb77a7d448104ca77f78435ab18c11a57c664539f1842107d698d44f.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
584KB
-
Filesize
4KB
-
Filesize
584KB