metasploit | b05ef36f8a5e480c23f28c792200f35b9ac5884f460194ec1c8e063e7759653e

General

Target

7187ec55dcd998f3ee207a0733a162604c40dc6920ef47424bcbaaa1dba68da3.dll
Size

673KB
MD5

f275ebb10010aa50fd9b5d8be10366ca
SHA1

99ce61ec58ac62c53685ba7812f155ba19c3fdf9
SHA256

7187ec55dcd998f3ee207a0733a162604c40dc6920ef47424bcbaaa1dba68da3
SHA512

79b2b2ce6cdbc1435124dba528798eff1e94d289dd6bd70f36cc2fde7a30a7d2b5108bf56fcda78bbf28a934a11fb8dbbb4ea5ca3ba83411728d8dd40fdf9405

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://puckhunterrr.com:443/image-directory/dhl.ico

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3560 created 796 3560 WerFault.exe regsvr32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3560 796 WerFault.exe regsvr32.exe

description	pid	process	target process
PID 3560 created 796	3560	WerFault.exe	regsvr32.exe

pid	pid_target	process	target process
3560	796	WerFault.exe	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3560	WerFault.exe
3560	WerFault.exe
3560	WerFault.exe
3560	WerFault.exe
3560	WerFault.exe
3560	WerFault.exe
3560	WerFault.exe
3560	WerFault.exe
3560	WerFault.exe
3560	WerFault.exe
3560	WerFault.exe
3560	WerFault.exe
3560	WerFault.exe
3560	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 3560 WerFault.exe

description	pid	process
Token: SeDebugPrivilege	3560	WerFault.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7187ec55dcd998f3ee207a0733a162604c40dc6920ef47424bcbaaa1dba68da3.dll
1⤵
PID:796

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 796 -s 1064
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/796-0-0x0000000002B20000-0x0000000002B2B000-memory.dmp

Filesize
44KB

Download
memory/796-1-0x000000006BAC0000-0x000000006BACD000-memory.dmp

Filesize
52KB

Download
memory/796-2-0x0000000002B50000-0x0000000002B51000-memory.dmp

Filesize
4KB

Download
memory/3560-3-0x00000199309B0000-0x00000199309B1000-memory.dmp

Filesize
4KB

Download
memory/3560-4-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-6-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-7-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-8-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-5-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-9-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-11-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-12-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-13-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-14-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-15-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-16-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-17-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-10-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-18-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-20-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-19-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-21-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-22-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-23-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-24-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-25-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-26-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-27-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-29-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-30-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-31-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-28-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-33-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-35-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-36-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-34-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-37-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-32-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-38-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-39-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-40-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-41-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-42-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-43-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-44-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-45-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-46-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-47-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-48-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-49-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-50-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-51-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-52-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-53-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-54-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-55-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-56-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download
memory/3560-57-0x0000019931360000-0x0000019931361000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads