metasploit | 9f3e0a082d374772dba3b6b795666b811ce92e986acba354d4de97263e56fca9

Analysis

max time kernel
148s
max time network
103s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/10/2026, 23:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7-zip.exe
Size 3.9MB
Sample261015-3rv8astwds
SHA256 9f3e0a082d374772dba3b6b795666b811ce92e986acba354d4de97263e56fca9
MD5 a6679049c64df58494264cdeefdf3205
SHA1 951770ff41c968b4a421cf0fc9de0fdcd57c7b62
SHA512 d039ad8eef0f2ee0fd66479f724695c7d73c194a79babe2fc0e1b6af10b5645eb1b5d875b788722e79c47097c8c6f949061f0f7f977723fe8e765dc720302f46
SSDEEP 98304:Cg+q4dfB9WAdkYhtxg0zlo6JX9oNthcfCGUE0cdTV8:CXNJ9WAGYhbb5XX9C/GUERTi
TLSH
T19816334C9408C0EBE9111E755BAECFE323E9BC005951880F739A7B36A7B5E45EE14F92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery metasploit trojan

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

159.223.160.74:11111

Signatures

Family: MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7-zip.exe

C:\Users\Admin\AppData\Local\Temp\7-zip.exe
"C:\Users\Admin\AppData\Local\Temp\7-zip.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4908-0-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

Download