metasploit | 1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c

General

Target

1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe
Size

1.1MB
MD5

abf13df77cefba6d01217f1734464842
SHA1

d2fff6e6d42540ef6570ca324706c73ee3a594f4
SHA256

1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c
SHA512

85a8af3703dfa17ee3933e7a14ec375fcd2bf4c6a3ecbfc2581d412d7dcab45f096ac77369af0728e045eaaffb001a7bf2a027d267442219e10f66b699c4a9c7

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of SetThreadContext 1 IoCs

Processes:

1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe

description	pid	process	target process
PID 1960 set thread context of 1116	1960	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe

description	pid	process	target process
PID 1960 wrote to memory of 1116	1960	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe
PID 1960 wrote to memory of 1116	1960	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe
PID 1960 wrote to memory of 1116	1960	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe
PID 1960 wrote to memory of 1116	1960	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe
PID 1960 wrote to memory of 1116	1960	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe
PID 1960 wrote to memory of 1116	1960	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe
PID 1960 wrote to memory of 1116	1960	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe
PID 1960 wrote to memory of 1116	1960	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe
PID 1960 wrote to memory of 1116	1960	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe
PID 1960 wrote to memory of 1116	1960	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe

C:\Users\Admin\AppData\Local\Temp\1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe
"C:\Users\Admin\AppData\Local\Temp\1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1960

C:\Users\Admin\AppData\Local\Temp\1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe
"C:\Users\Admin\AppData\Local\Temp\1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe"
2⤵
PID:1116

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1116-63-0x0000000029A00000-0x0000000029A1E000-memory.dmp

Filesize
120KB

Download
memory/1116-62-0x0000000029A00000-0x0000000029A1E000-memory.dmp

Filesize
120KB

Download
memory/1116-60-0x0000000029A00000-0x0000000029A1E000-memory.dmp

Filesize
120KB

Download
memory/1116-58-0x0000000029A00000-0x0000000029A1E000-memory.dmp

Filesize
120KB

Download
memory/1116-57-0x0000000029A00000-0x0000000029A1E000-memory.dmp

Filesize
120KB

Download
memory/1116-56-0x0000000029A00000-0x0000000029A1E000-memory.dmp

Filesize
120KB

Download
memory/1960-55-0x0000000076511000-0x0000000076513000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing