Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
28-12-2024 23:03
General
-
Target
payload.exe
-
Size
72KB
-
MD5
a761195663b6d4ca21daf517faaa1765
-
SHA1
39dfc688001598806bf44eb1cfc08281a1566d7c
-
SHA256
82a539dd37e4628199a5c9cccf2ac826a64cfe3023eaeb35bc7300acfc6d6871
-
SHA512
89322d9b3e9595e6e2feca0b9fc26099bddbc245454f51441ca5f01235545bdaf493486f774486a1555143f13efa90d318ebb2a846ecbc885d0f3d4e4342c517
-
SSDEEP
1536:IcazskDvluMDDtE4KFaKVWXMb+KR0Nc8QsJq39:dTkDv0QWdaKwe0Nc8QsC9
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
windows/shell_reverse_tcp
C2
192.168.1.115:4444
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\payload.exe"C:\Users\Admin\AppData\Local\Temp\payload.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB