metasploit | 8c12a4053e0f255b184eed53afd60d9e3102cdba178dbc6b54aeffb7b58dfa45

Analysis

max time kernel
141s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2024 01:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c12a4053e0f255b184eed53afd60d9e3102cdba178dbc6b54aeffb7b58dfa45.exe
Size

9.8MB
MD5

110c5d49efc5eb2db0e91490728d3be9
SHA1

7fc790f7977b2e55a53d5f789d4098c71ef2025e
SHA256

8c12a4053e0f255b184eed53afd60d9e3102cdba178dbc6b54aeffb7b58dfa45
SHA512

78e5500d0b5ae36807f45912b2525df34e203c1f241702aaca5efc4167285c889fca632a2f6645afb62eef80830ff8bd2b81748cf3294eb62ac146fb448499e6
SSDEEP

196608:za4i3zQL1CW+jMZczEN7QwgV7NUuvtYTDoBu40sxRxjAkt5o9:IM5CHMyU7QwgV7+uvtYTDoAhsxRRbo9

Score

10^/10

metasploit backdoor discovery trojan

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

10.84.142.252:1234

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Executes dropped EXE 1 IoCs

pid	Process
2476	8c12a4053e0f255b184eed53afd60d9e3102cdba178dbc6b54aeffb7b58dfa45.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8c12a4053e0f255b184eed53afd60d9e3102cdba178dbc6b54aeffb7b58dfa45.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8c12a4053e0f255b184eed53afd60d9e3102cdba178dbc6b54aeffb7b58dfa45.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 2476	3336	8c12a4053e0f255b184eed53afd60d9e3102cdba178dbc6b54aeffb7b58dfa45.exe	83
PID 3336 wrote to memory of 2476	3336	8c12a4053e0f255b184eed53afd60d9e3102cdba178dbc6b54aeffb7b58dfa45.exe	83
PID 3336 wrote to memory of 2476	3336	8c12a4053e0f255b184eed53afd60d9e3102cdba178dbc6b54aeffb7b58dfa45.exe	83

C:\Users\Admin\AppData\Local\Temp\8c12a4053e0f255b184eed53afd60d9e3102cdba178dbc6b54aeffb7b58dfa45.exe
"C:\Users\Admin\AppData\Local\Temp\8c12a4053e0f255b184eed53afd60d9e3102cdba178dbc6b54aeffb7b58dfa45.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Users\Admin\AppData\Local\Temp\is-KSHP8.tmp\8c12a4053e0f255b184eed53afd60d9e3102cdba178dbc6b54aeffb7b58dfa45.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-KSHP8.tmp\8c12a4053e0f255b184eed53afd60d9e3102cdba178dbc6b54aeffb7b58dfa45.tmp" /SL5="$50236,9469063,832512,C:\Users\Admin\AppData\Local\Temp\8c12a4053e0f255b184eed53afd60d9e3102cdba178dbc6b54aeffb7b58dfa45.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-KSHP8.tmp\8c12a4053e0f255b184eed53afd60d9e3102cdba178dbc6b54aeffb7b58dfa45.tmp

Filesize
3.1MB

MD5
b60c22298da5c99b9c165809d17a6b25

SHA1
7b0b68f4b63f0b1931e62ad2eeb0ddb4f5543b1d

SHA256
7528cd9ed88530129aecdbb962c4db242ae28a5a8abcfcea4d4a56b0288ac2d9

SHA512
85bd43cad22cf92821bc4e4a166f65ed5ed26ab7ea0f8c65233ea5d5a7151538fb29bef2d71d6fd2f1a3b99db59246cf9a08b3e645e9a0db0cfc0fe1d2648867

Download Submit
memory/2476-28-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2476-26-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2476-16-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2476-8-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2476-37-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2476-18-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2476-12-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2476-20-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2476-39-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2476-35-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2476-14-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2476-22-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2476-24-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2476-33-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2476-30-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/3336-0-0x0000000000E00000-0x0000000000E01000-memory.dmp

Filesize
4KB

Download
memory/3336-4-0x0000000000400000-0x0000000000DE6000-memory.dmp

Filesize
9.9MB

Download
memory/3336-11-0x0000000000400000-0x0000000000DE6000-memory.dmp

Filesize
9.9MB

Download
memory/3336-10-0x0000000000E00000-0x0000000000E01000-memory.dmp

Filesize
4KB

Download
memory/3336-3-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download