metasploit | 2d224f2928987e47e0144b42dcb5a4aae97ffacb23783856d122cc7598da5763 | Triage

Analysis

max time kernel
143s
max time network
151s
platform
windows10_x64
resource
win10v20201028
submitted
11-11-2020 10:52

Sharing

Report Analysis Logs

General

Target

2d224f2928987e47e0144b42dcb5a4aae97ffacb23783856d122cc7598da5763.exe
Size

3.4MB
MD5

ce63c6b94bda4ac95581362937773b37
SHA1

4e8f215aafa892595f51a107b17f6f7dd0855ee5
SHA256

2d224f2928987e47e0144b42dcb5a4aae97ffacb23783856d122cc7598da5763
SHA512

fbf9dd0d1b039775a82d27f93b4fb19f604806597ec0eecfad749787f5ff102f4608ea930b1ddb0d63efc597a9b1cf117cdd9bbf57e03d73d8d244d9a9df544a

Score

10^/10

metasploit backdoor trojan vmprotect

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://47.91.237.42:8443/blIF

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral2/memory/640-0-0x0000000000E40000-0x0000000001464000-memory.dmp	vmprotect

C:\Users\Admin\AppData\Local\Temp\2d224f2928987e47e0144b42dcb5a4aae97ffacb23783856d122cc7598da5763.exe
"C:\Users\Admin\AppData\Local\Temp\2d224f2928987e47e0144b42dcb5a4aae97ffacb23783856d122cc7598da5763.exe"
1⤵
PID:640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/640-0-0x0000000000E40000-0x0000000001464000-memory.dmp

Filesize
6.1MB

Download