Analysis

  • max time kernel
    105s
  • max time network
    113s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-12-2024 09:25

General

  • Target

    366fb7750197a9ce4450d2f91830007eb17ff68af74e450be8a740793ba1a396N.exe

  • Size

    3.7MB

  • MD5

    7604d0407906197f3a8589675ec07300

  • SHA1

    3edf69330041808d8899d6ce87c82f10650b4d69

  • SHA256

    366fb7750197a9ce4450d2f91830007eb17ff68af74e450be8a740793ba1a396

  • SHA512

    d2b6aa60dcbe0c5c2297c248f8d2b573e22aff3e68b0cfb47c89dd98bf55760ba2a3179f922f8d522f01809e2b97f74acaf1f81b590bbff68bf5cfb268450bd4

  • SSDEEP

    49152:nUUvltf6SGd/FGfIsTE665h0dEY2nU5h0dEY2:UUveSGt4NTEH5xJnU5xJ

Malware Config

Extracted

Family

metasploit

Version

metasploit_stager

C2

192.168.0.194:5555

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Metasploit family
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

Processes

  • C:\Users\Admin\AppData\Local\Temp\366fb7750197a9ce4450d2f91830007eb17ff68af74e450be8a740793ba1a396N.exe
    "C:\Users\Admin\AppData\Local\Temp\366fb7750197a9ce4450d2f91830007eb17ff68af74e450be8a740793ba1a396N.exe"
    1⤵
      PID:1180

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1180-0-0x0000000140000000-0x00000001406A48D4-memory.dmp

      Filesize

      6.6MB