General

  • Target

    SalaryPayment.docm

  • Size

    82KB

  • Sample

    241217-l8vveswrd1

  • MD5

    c9e4343e22111ea45bac6ca69d746d0e

  • SHA1

    8fdbeb686d74118df1f4af3d08cae155f7dcc8b5

  • SHA256

    ecb4ebff87ef24a8a2f929ed19f4db7e5191e8805b66c476ddeb4a1079f744df

  • SHA512

    182ec72987d8794203ad390eb18a35cd85150ff0e381647f216ac2a30d015acf039040dd221ca78c1164e08aa31f140bc44837278e9669b77352083f1777d012

  • SSDEEP

    1536:NO+BltfgTv5KXb1Y99mD3oJ7N914fspHD7iysQ/xVtH0JN5tYC1sFuu5O:xlarMy9Qo3Hays0WJNrt1sEu8

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

172.16.16.13:4444

Targets

    • Target

      Device/HarddiskVolume3/Users/Demo/Downloads/SalaryPayment.docm

    • Size

      83KB

    • MD5

      46d71e324f8a183ff2fc25639501064e

    • SHA1

      049d20520cdff2c9de0e084acc7c74b38a0a32bf

    • SHA256

      8c19b0a81eca2b255bd301735b5ee22f8e4558aab3cb94175d7f579dfc3ea7f6

    • SHA512

      7c8a73376ba5ab65ce11234ec8cca578b0012751c97b4273887e3741fb543a41e676076714bbbc080197529e3f82c756e4949159bcd5a33573786c51528bf927

    • SSDEEP

      1536:AH+WqQuctgdcmf511SRYOGYEwQu5MaMiIRcOOzwFd0mCdXmi8OXCld:o+X8YRHWnhdMaTQO2dbCdXm5OC/

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Metasploit family

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks