Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
26/03/2025, 14:01
General
-
Target
Accounts.exe
-
Size
72KB
-
MD5
c4cdc9339fd011ad37343ae78b0ac1ca
-
SHA1
afec1b8313a50a77d94cc90adac3cd9760d54c13
-
SHA256
bb45c429eb89c608955e6be294cdf1fd04f93fbe4f7404646a5ec61909349ab9
-
SHA512
8a06e34ef64057798ee23fe68fd1986fcba4c31ab63ab8174cff99c9573ec484795f6a1d5f374f7c162f669e70b57c904d4f69799a7fc4e93fc6d77f2a17c6b5
-
SSDEEP
1536:I5brQdhRXP8nKk043eFj62Mb+KR0Nc8QsJq39:Y4NXP8nhgW2e0Nc8QsC9
Malware Config
Extracted
metasploit
windows/reverse_http
http://89.197.154.116:7810/3YZTBQ0GC8KnG6YawPl6Mgz0SxPZaRsi_90j21JnLh06BUCTxqSYQSXq2kUtERpN-N0gOu_rEQPmJD0K2aYCURoIcsBtBmn9lNaP2BTIV0Qjrn_Q3PNQu4TgvDjF2TK1ORITX7MdyZp277NZKK3EZ0q-lrqP
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Accounts.exe"C:\Users\Admin\AppData\Local\Temp\Accounts.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4.0MB