Analysis
-
max time kernel
94s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13-12-2024 14:15
General
-
Target
星辰魔域.exe
-
Size
1.8MB
-
MD5
af25dc5a87ceeef592b39db453556cc5
-
SHA1
d7144da6707271544dceef81767a731db26c0f70
-
SHA256
57e1237c4831d5bad7540e135015262a9f3666c88b3eeebe2181157093498a36
-
SHA512
e4c0fc8b166c04bdf8580b882a975dce00d67ec3083be73fdc5037f2fc331ccd7e23a3144a993c0123c04d316f3c545437ce76dfb58db2180507ade339cf06a4
-
SSDEEP
24576:/3vLRdVhZBK8NogWYO09YOGi9J3YiWdCMJ5QxmjwC/hR:/3d5ZQ1YxJIiW0MbQxA
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
windows/shell_reverse_tcp
C2
1.15.12.73:4567
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\星辰魔域.exe"C:\Users\Admin\AppData\Local\Temp\星辰魔域.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.9MB