metasploit | 04fa8c47323d6fec418f42eae227b6a278b5e9e28b5b537da48c631da4381f7d

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 16:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
04fa8c47323d6fec418f42eae227b6a278b5e9e28b5b537da48c631da4381f7d.exe
Size 7KB
Sample260701-tvycdsh12l
SHA256 04fa8c47323d6fec418f42eae227b6a278b5e9e28b5b537da48c631da4381f7d
MD5 99a453c050775db9d7a16deb4c55cc45
SHA1 57f6b684abdcc993e523f972543d96fbb9ee6ad7
SHA512 1e3f8741eb23ceb751b93171f30559a6a063f11dea7b4fc0cd973aa46a2abb58a9a49ac44474044232aeffb2018def56a524803a5662e4b1a5aa274b3bf92400
SSDEEP 24:eFGSG9wSHUIabMy58XZh9h9ClfAhudsIAJKf44up+:iG+SxfyeXZh9hMluudsJ54b
TLSH
T172E123A7A2369CF6F7392B7C46439BC660FC773442D34B0D0A64048A5192A19B8E5F83
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery metasploit trojan

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

192.168.79.131:8888

Signatures

Family: MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	04fa8c47323d6fec418f42eae227b6a278b5e9e28b5b537da48c631da4381f7d.exe

C:\Users\Admin\AppData\Local\Temp\04fa8c47323d6fec418f42eae227b6a278b5e9e28b5b537da48c631da4381f7d.exe
"C:\Users\Admin\AppData\Local\Temp\04fa8c47323d6fec418f42eae227b6a278b5e9e28b5b537da48c631da4381f7d.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2416-0-0x0000000000400000-0x00000000004051C8-memory.dmp

Download

memory/2416-1-0x0000000000400000-0x00000000004051C8-memory.dmp