metasploit | 03421b2ad40a6dcfb539c54c2b14f02531b1c1f71f50f29a770fbe55fe4f6e70

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 10:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WindowsUpdate.exe
Size 7KB
Sample260531-m2579ae121
SHA256 03421b2ad40a6dcfb539c54c2b14f02531b1c1f71f50f29a770fbe55fe4f6e70
MD5 ec812d2ad98c306d9c1987872cb0ed17
SHA1 b17c80d269498a9f658adee11638e4b046de2e62
SHA512 c58ca693b708060cc40c430eb7dea87180e53e9d3b19884b1ffc50ddd0de3ea07e79bf8bda470de94308bfb6ef99308657115cf483bff7de95b480e04d98838a
SSDEEP 24:eFGSG9wSk/wUI/My58XZh9h9ClfAhGOjJPIAJL4up+:iG+R/wxkyeXZh9hMluGcJL4b
TLSH
T12DE100A792365CF7F6392BBD4143978660FC733442931A0D0A64084A5192A19BCA5F93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery metasploit trojan

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

192.168.56.3:4444

Signatures

Family: MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsUpdate.exe

C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
"C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4388-0-0x0000000000400000-0x00000000004051C8-memory.dmp

Download

memory/4388-1-0x0000000000400000-0x00000000004051C8-memory.dmp