metasploit | 69273edbd99a25f03598491e54f80afbfe1d3b18bdc14cbbf013b087da0e796f | Triage

Analysis

max time kernel
143s
max time network
144s
platform
windows7_x64
resource
win7v20201028
submitted
17-11-2020 11:22

Sharing

Report Analysis Logs

General

Target

2ecd1b370d2c29b27160ca1a8e18df1b.exe
Size

3.4MB
MD5

99f86cf700ff068ed4ca2d22d048c454
SHA1

67d36aa210cabc861e41289daab6efd1ddd68298
SHA256

69273edbd99a25f03598491e54f80afbfe1d3b18bdc14cbbf013b087da0e796f
SHA512

cc418790124c5f5564acd7da887b2e8ecf3a425020e76943e27159dcfff737fe5cff6d8a0230744ba0d39c48cbe15e2446d0e8e124e81fb66668f72eb025f9e1

Score

10^/10

metasploit backdoor trojan vmprotect

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://47.91.237.42:8443/blIF

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/340-0-0x00000000000A0000-0x00000000006CA000-memory.dmp	vmprotect
behavioral1/memory/340-1-0x00000000000A0000-0x00000000006CA000-memory.dmp	vmprotect
behavioral1/memory/340-2-0x00000000000A0000-0x00000000006CA000-memory.dmp	vmprotect

C:\Users\Admin\AppData\Local\Temp\2ecd1b370d2c29b27160ca1a8e18df1b.exe
"C:\Users\Admin\AppData\Local\Temp\2ecd1b370d2c29b27160ca1a8e18df1b.exe"
1⤵
PID:340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/340-0-0x00000000000A0000-0x00000000006CA000-memory.dmp

Filesize
6.2MB

Download
memory/340-1-0x00000000000A0000-0x00000000006CA000-memory.dmp

Filesize
6.2MB

Download
memory/340-2-0x00000000000A0000-0x00000000006CA000-memory.dmp

Filesize
6.2MB

Download
memory/608-3-0x000007FEF6970000-0x000007FEF6BEA000-memory.dmp

Filesize
2.5MB

Download