metasploit | d5eb97a976f21c390d17f818f03e5ae95d52c2db00bcb714a9fe6ae2e3ae5581 | Triage™

Analysis

max time kernel
17s
max time network
115s
platform
windows10_x64
resource
win10v20210408
submitted
19/06/2021, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
charlotte.dll
Size 92KB
Sample210619-m3gc9rr9f2
SHA256 d5eb97a976f21c390d17f818f03e5ae95d52c2db00bcb714a9fe6ae2e3ae5581
MD5 8613d0b0aaf3092013204e960f7b7aa6
SHA1 df359b35086eb0602e70ddee9fd290cc9a937606
SHA512 f1a257f4e97f81a4c8c5c575cfe5029df11938743f576a485260efd6db68448bf48e131de9f62cd078d658cb1b6a94cc178060d74a278a5d24942d6a15ff3ed1
MD5 SHA1 SHA512

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

metasploit_stager

C2

198.13.63.107:8888

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Blocklisted process makes network request 10 IoCs

flow	pid	Process
1	900	rundll32.exe
1	900	rundll32.exe
1	900	rundll32.exe
1	900	rundll32.exe
1	900	rundll32.exe
1	900	rundll32.exe
1	900	rundll32.exe
1	900	rundll32.exe
1	900	rundll32.exe
1	900	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\charlotte.dll,#1
1⤵
- Blocklisted process makes network request
PID:900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-114-0x0000016EFDE00000-0x0000016EFDE01000-memory.dmp

Download