metasploit | b05ef36f8a5e480c23f28c792200f35b9ac5884f460194ec1c8e063e7759653e | Triage

Analysis

max time kernel
6s
max time network
8s
platform
windows7_x64
resource
win7v20201028
submitted
23-11-2020 07:27

Sharing

Report Analysis Logs

General

Target

7187ec55dcd998f3ee207a0733a162604c40dc6920ef47424bcbaaa1dba68da3.dll
Size

673KB
MD5

f275ebb10010aa50fd9b5d8be10366ca
SHA1

99ce61ec58ac62c53685ba7812f155ba19c3fdf9
SHA256

7187ec55dcd998f3ee207a0733a162604c40dc6920ef47424bcbaaa1dba68da3
SHA512

79b2b2ce6cdbc1435124dba528798eff1e94d289dd6bd70f36cc2fde7a30a7d2b5108bf56fcda78bbf28a934a11fb8dbbb4ea5ca3ba83411728d8dd40fdf9405

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://puckhunterrr.com:443/image-directory/dhl.ico

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7187ec55dcd998f3ee207a0733a162604c40dc6920ef47424bcbaaa1dba68da3.dll
1⤵
PID:1688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1604-3-0x000007FEF7080000-0x000007FEF72FA000-memory.dmp

Filesize
2.5MB

Download
memory/1688-0-0x00000000001B0000-0x00000000001BB000-memory.dmp

Filesize
44KB

Download
memory/1688-1-0x000000006BAC0000-0x000000006BACD000-memory.dmp

Filesize
52KB

Download
memory/1688-2-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download