metasploit | 9e73b71493e907242d7330797e81c95f282cc414ee14f7790c0853aa188aa84d | Triage

Analysis

max time kernel
137s
max time network
136s
platform
windows7_x64
resource
win7v20201028
submitted
11-11-2020 10:53

Sharing

Report Analysis Logs

General

Target

9e73b71493e907242d7330797e81c95f282cc414ee14f7790c0853aa188aa84d.exe
Size

3.4MB
MD5

2ecd1b370d2c29b27160ca1a8e18df1b
SHA1

043ce493c650fbf65bc71cc323ff7e409878b263
SHA256

9e73b71493e907242d7330797e81c95f282cc414ee14f7790c0853aa188aa84d
SHA512

fa4ca1702631974e3d55517b9e8642652423215ad3ad99bde8520f0bc550f2771320860c0730d5c1d932b0923082b713c549d35d683a482a718793cc0a046b0b

Score

10^/10

metasploit backdoor trojan vmprotect

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://47.91.237.42:8443/blIF

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/1660-0-0x0000000000D20000-0x000000000134A000-memory.dmp	vmprotect
behavioral1/memory/1660-1-0x0000000000D20000-0x000000000134A000-memory.dmp	vmprotect
behavioral1/memory/1660-2-0x0000000000D20000-0x000000000134A000-memory.dmp	vmprotect

C:\Users\Admin\AppData\Local\Temp\9e73b71493e907242d7330797e81c95f282cc414ee14f7790c0853aa188aa84d.exe
"C:\Users\Admin\AppData\Local\Temp\9e73b71493e907242d7330797e81c95f282cc414ee14f7790c0853aa188aa84d.exe"
1⤵
PID:1660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1524-3-0x000007FEF6F80000-0x000007FEF71FA000-memory.dmp

Filesize
2.5MB

Download
memory/1660-0-0x0000000000D20000-0x000000000134A000-memory.dmp

Filesize
6.2MB

Download
memory/1660-1-0x0000000000D20000-0x000000000134A000-memory.dmp

Filesize
6.2MB

Download
memory/1660-2-0x0000000000D20000-0x000000000134A000-memory.dmp

Filesize
6.2MB

Download