metasploit | 34ad78b63ae71cc1ffda60c572b89ad931abd237499c8aeb3372ee00816e0300 | Triage

Analysis

max time kernel
24s
max time network
110s
platform
windows10_x64
resource
win10v20201028
submitted
06-03-2021 15:53

Sharing

Report Analysis Logs

General

Target

7217ed367a528c6404c9f8da2387a108.exe
Size

55KB
MD5

7217ed367a528c6404c9f8da2387a108
SHA1

7aed398895b9a02b74b8905480ce53a243be3c0b
SHA256

34ad78b63ae71cc1ffda60c572b89ad931abd237499c8aeb3372ee00816e0300
SHA512

71d8499e52e33783d19ff399f5d392d8525f2176364402dc830b522181b50e0290e5e98f39e531129d1e172555d2e4477969b6025bff9871b3c3c4636eb421c8

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://182.92.155.100:443/collect/v2/

Attributes

headers Host: www.microsoft.com Accept: */* Accept-Language: en-US,en;q=0.5 X-Goog-Visitor-Id: CgtGbFYxTWlKTU96VQ== X-Microsoft-Client-Name: 56 X-Microsoft-Client-Version: 20171026 User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.40

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

7217ed367a528c6404c9f8da2387a108.exe

description pid process

Token: SeDebugPrivilege 3116 7217ed367a528c6404c9f8da2387a108.exe

C:\Users\Admin\AppData\Local\Temp\7217ed367a528c6404c9f8da2387a108.exe
"C:\Users\Admin\AppData\Local\Temp\7217ed367a528c6404c9f8da2387a108.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3116-2-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download