metasploit | 49f80e9afca6ccd55838cd0e16639d51ed5db3d751f36ba7d79ea0678b50da6a | Triage™

Analysis

max time kernel
146s
max time network
147s
platform
windows10_x64
resource
win10v20201028
submitted
10/11/2020, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
49f80e9afca6ccd55838cd0e16639d51ed5db3d751f36ba7d79ea0678b50da6a.exe
Size 275KB
Sample201110-h8pfl74v9x
SHA256 49f80e9afca6ccd55838cd0e16639d51ed5db3d751f36ba7d79ea0678b50da6a
MD5 64e6a76b7bfdd1a130c2bb64ab92cf75
SHA1 39caec38241b08286a1a52d87dbfdc1a10fb91b8
SHA512 5ac8a8034c935f75b496717eceb00b6f594d1a4ec527a12f7ae8d4b078debe9a5ce95c6e5838811386dd060371ab13c9abdeb1bf297c6df007d9dd972ce89b9b
MD5 SHA1 SHA512

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://144.48.9.115:443/YCiX

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2432 created 1680	2432	49f80e9afca6ccd55838cd0e16639d51ed5db3d751f36ba7d79ea0678b50da6a.exe	57

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2432	49f80e9afca6ccd55838cd0e16639d51ed5db3d751f36ba7d79ea0678b50da6a.exe
2432	49f80e9afca6ccd55838cd0e16639d51ed5db3d751f36ba7d79ea0678b50da6a.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 580	2432	49f80e9afca6ccd55838cd0e16639d51ed5db3d751f36ba7d79ea0678b50da6a.exe	68
PID 2432 wrote to memory of 580	2432	49f80e9afca6ccd55838cd0e16639d51ed5db3d751f36ba7d79ea0678b50da6a.exe	68
PID 2432 wrote to memory of 580	2432	49f80e9afca6ccd55838cd0e16639d51ed5db3d751f36ba7d79ea0678b50da6a.exe	68

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1680
- C:\Users\Admin\AppData\Local\Temp\49f80e9afca6ccd55838cd0e16639d51ed5db3d751f36ba7d79ea0678b50da6a.exe
  "C:\Users\Admin\AppData\Local\Temp\49f80e9afca6ccd55838cd0e16639d51ed5db3d751f36ba7d79ea0678b50da6a.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2432
- C:\Windows\System32\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  PID:580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads