Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2024 20:06
Static task
static1
Behavioral task
behavioral1
Sample
4e1d166f0642c2fbac91bb661a117c9724753594341df8177a11612c23c77967.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4e1d166f0642c2fbac91bb661a117c9724753594341df8177a11612c23c77967.exe
Resource
win10v2004-20241007-en
General
-
Target
4e1d166f0642c2fbac91bb661a117c9724753594341df8177a11612c23c77967.exe
-
Size
7KB
-
MD5
e4173a395475598d17fb57122f19c7f0
-
SHA1
cc2a09560843aa264db728595bd3a8393add8585
-
SHA256
4e1d166f0642c2fbac91bb661a117c9724753594341df8177a11612c23c77967
-
SHA512
73560a3427a49c95b733e7fb1f141219df8e030f33429de396d722d78b93d9e591ce1f66d9ecb3f4f615fe8c344f5a0b9ec284a6f4b16cce686f2cc20384ab89
-
SSDEEP
24:eFGStrJ9u0/693NnZdfgBQAVtAH4DXHWC8cqSGe3f+7gkPZUiyZSaVjNAa2X/IEL:is0wN4BQKAYjHdLFGBTR2P2X/be2B
Malware Config
Extracted
metasploit
metasploit_stager
206.41.208.89:4678
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
Processes
Network
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request209.205.72.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request88.210.23.2.in-addr.arpaIN PTRResponse88.210.23.2.in-addr.arpaIN PTRa2-23-210-88deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request232.168.11.51.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request200.163.202.172.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request241.42.69.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request69.190.18.2.in-addr.arpaIN PTRResponse69.190.18.2.in-addr.arpaIN PTRa2-18-190-69deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request83.210.23.2.in-addr.arpaIN PTRResponse83.210.23.2.in-addr.arpaIN PTRa2-23-210-83deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request83.210.23.2.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request14.227.111.52.in-addr.arpaIN PTRResponse
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
209.205.72.20.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
88.210.23.2.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
97.17.167.52.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
232.168.11.51.in-addr.arpa
-
74 B 160 B 1 1
DNS Request
200.163.202.172.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
241.42.69.40.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
69.190.18.2.in-addr.arpa
-
140 B 133 B 2 1
DNS Request
83.210.23.2.in-addr.arpa
DNS Request
83.210.23.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
14.227.111.52.in-addr.arpa