metasploit | 1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c

General

Target

1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe
Size

1.1MB
MD5

abf13df77cefba6d01217f1734464842
SHA1

d2fff6e6d42540ef6570ca324706c73ee3a594f4
SHA256

1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c
SHA512

85a8af3703dfa17ee3933e7a14ec375fcd2bf4c6a3ecbfc2581d412d7dcab45f096ac77369af0728e045eaaffb001a7bf2a027d267442219e10f66b699c4a9c7

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of SetThreadContext 1 IoCs

Processes:

1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe

description	pid	process	target process
PID 2628 set thread context of 3460	2628	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3732 3460 WerFault.exe 1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe

pid	pid_target	process	target process
3732	3460	WerFault.exe	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe

description	pid	process	target process
PID 2628 wrote to memory of 3460	2628	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe
PID 2628 wrote to memory of 3460	2628	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe
PID 2628 wrote to memory of 3460	2628	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe
PID 2628 wrote to memory of 3460	2628	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe
PID 2628 wrote to memory of 3460	2628	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe
PID 2628 wrote to memory of 3460	2628	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe
PID 2628 wrote to memory of 3460	2628	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe
PID 2628 wrote to memory of 3460	2628	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe
PID 2628 wrote to memory of 3460	2628	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe	1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe

C:\Users\Admin\AppData\Local\Temp\1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe
"C:\Users\Admin\AppData\Local\Temp\1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2628

C:\Users\Admin\AppData\Local\Temp\1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe
"C:\Users\Admin\AppData\Local\Temp\1e35ab4e4a1c4c42c6fbc59eb83a6b70a40750ab32edcb8de184cba3b1686c8c.exe"
2⤵
PID:3460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3460 -s 24
3⤵
- Program crash
PID:3732

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3460-118-0x0000000029A00000-0x0000000029A1E000-memory.dmp

Filesize
120KB

Download
memory/3460-119-0x0000000029A00000-0x0000000029A1E000-memory.dmp

Filesize
120KB

Download
memory/3460-120-0x0000000029A00000-0x0000000029A1E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing