Analysis
-
max time kernel
110s -
max time network
115s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
26-11-2024 21:04
General
-
Target
18cedfacb721e33bb9571f013fa2cdf29bb29b74335fa3a643abd017ad8dd964N.exe
-
Size
47KB
-
MD5
ff100b4696f08652a8043a9c75524a00
-
SHA1
cd81d89cf83e642eeea356adc3bb65887aa8446a
-
SHA256
18cedfacb721e33bb9571f013fa2cdf29bb29b74335fa3a643abd017ad8dd964
-
SHA512
cc5eaf2bf9409e72eefa65dc68a88198a3373c2c007633c2db60de7ba838a079698d1aa0b02e04c603e59fc167766de17853c6555c7e1637f8eb96e811e04102
-
SSDEEP
768:IPnQk+CXzoRmDM2OOWhNx61m7jZMLp/WQ76sVtuNfUqAszPMHl91fs06iGiq3:IPnQ4zGyT2NvZMwQ7xLuxxmP14iZq3
Malware Config
Extracted
metasploit
windows/reverse_tcp
10.10.5.1:4444
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\18cedfacb721e33bb9571f013fa2cdf29bb29b74335fa3a643abd017ad8dd964N.exe"C:\Users\Admin\AppData\Local\Temp\18cedfacb721e33bb9571f013fa2cdf29bb29b74335fa3a643abd017ad8dd964N.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
-
Filesize
4KB
-
Filesize
100KB