Analysis

  • max time kernel
    147s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    25-11-2024 08:58

General

  • Target

    740cdd7a4679b0a49b66ee37999dae25d8793f2e8f155d20164748951ad724d5.exe

  • Size

    616KB

  • MD5

    8a5e9a49cb3ff1acf73bcf1bc50b7743

  • SHA1

    12b3ff9962e4849f436d087fe0e173ac3e17a9b7

  • SHA256

    740cdd7a4679b0a49b66ee37999dae25d8793f2e8f155d20164748951ad724d5

  • SHA512

    513dec55fc41972ffdb0acbe1fac082f05454573f787ca9a3e0aaf6c70a625ca0f36718f35535f3d0710c67beb07ca3875beafbb1146236cd77bae2201caa9e2

  • SSDEEP

    3072:pwYshsrdQMvt1j4TspdlJOl5lsJ9//S418PWZ8m1Xy7Q+smujtE8IhRs0ABR:JsmxH4Adil5lscGBR

Malware Config

Extracted

Family

metasploit

Version

metasploit_stager

C2

172.16.20.81:8885

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Metasploit family

Processes

  • C:\Users\Admin\AppData\Local\Temp\740cdd7a4679b0a49b66ee37999dae25d8793f2e8f155d20164748951ad724d5.exe
    "C:\Users\Admin\AppData\Local\Temp\740cdd7a4679b0a49b66ee37999dae25d8793f2e8f155d20164748951ad724d5.exe"
    1⤵
      PID:2504

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2504-0-0x0000000140000000-0x0000000140011000-memory.dmp

      Filesize

      68KB

    • memory/2504-1-0x0000000140000000-0x0000000140011000-memory.dmp

      Filesize

      68KB

    • memory/2504-2-0x000000013F200000-0x000000013F29D000-memory.dmp

      Filesize

      628KB