metasploit | 9b5063189c2dd0550c422662883b23b243a72d97a8d55e80236328aed1625a3c | Triage

Analysis

max time kernel
132s
max time network
134s
platform
windows7_x64
resource
win7v20201028
submitted
11-11-2020 10:53

Sharing

Report Analysis Logs

General

Target

9b5063189c2dd0550c422662883b23b243a72d97a8d55e80236328aed1625a3c.exe
Size

3.3MB
MD5

8c0c79a1d225b583724e6d6cb97d2640
SHA1

d86f98b0f4c965a2f5e41ebdeb54388890967450
SHA256

9b5063189c2dd0550c422662883b23b243a72d97a8d55e80236328aed1625a3c
SHA512

6029b4df1048897d941682bc1379d27017f5d0cc2b6724ee5a46c5b54f2f41cb8c2d10e7beca56ec214c77a51a2364dbf5341ef4279af707767659a95671ce18

Score

10^/10

metasploit backdoor trojan vmprotect

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://47.91.237.42:8443/blIF

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/1704-0-0x0000000000400000-0x0000000000A0E000-memory.dmp	vmprotect
behavioral1/memory/1704-1-0x0000000000400000-0x0000000000A0E000-memory.dmp	vmprotect
behavioral1/memory/1704-2-0x0000000000400000-0x0000000000A0E000-memory.dmp	vmprotect

C:\Users\Admin\AppData\Local\Temp\9b5063189c2dd0550c422662883b23b243a72d97a8d55e80236328aed1625a3c.exe
"C:\Users\Admin\AppData\Local\Temp\9b5063189c2dd0550c422662883b23b243a72d97a8d55e80236328aed1625a3c.exe"
1⤵
PID:1704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/324-3-0x000007FEF69C0000-0x000007FEF6C3A000-memory.dmp

Filesize
2.5MB

Download
memory/1704-0-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/1704-1-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/1704-2-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download