Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    26-12-2024 03:06

General

  • Target

    99ac306ba27637132a760e80df7931fc4918234238a79b3fa3d646407e03aa4f.exe

  • Size

    6KB

  • MD5

    e241d82588fdf19cc15a8f8b3e4f8ff0

  • SHA1

    479b9486e4bb886e80c9558987691246195fc405

  • SHA256

    99ac306ba27637132a760e80df7931fc4918234238a79b3fa3d646407e03aa4f

  • SHA512

    e1d54dc4dec0b59042ee1cc67a964f96e9806d195fefe6a146cc260a42f1e3c84866101a37fe3487081b74d8f656e91b55ffb8bcc64a0381e4b07a4983dd0740

  • SSDEEP

    24:eFGStrJ9u084Wg2nbShVkzv05bUI5VRIkLZMrvt6GBQAVN:is0DEbS7ksbUI5XfLnGBQu

Malware Config

Extracted

Family

metasploit

Version

metasploit_stager

C2

193.34.175.49:1337

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Metasploit family

Processes

  • C:\Users\Admin\AppData\Local\Temp\99ac306ba27637132a760e80df7931fc4918234238a79b3fa3d646407e03aa4f.exe
    "C:\Users\Admin\AppData\Local\Temp\99ac306ba27637132a760e80df7931fc4918234238a79b3fa3d646407e03aa4f.exe"
    1⤵
      PID:2356

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2356-0-0x0000000140000000-0x0000000140004000-memory.dmp

      Filesize

      16KB

    • memory/2356-1-0x0000000140000000-0x0000000140004000-memory.dmp

      Filesize

      16KB