metasploit | 1811acc99aa3297467e8a83676093cecf1afb3ece96de2374b7b37be72aeeb7b

General

Target

1811acc99aa3297467e8a83676093cecf1afb3ece96de2374b7b37be72aeeb7b.exe
Size

798KB
MD5

655c95c31c9745f6e7babd65a0d6758d
SHA1

dd8d3ba921b3458b9674758abe01b7ebe4b062e9
SHA256

1811acc99aa3297467e8a83676093cecf1afb3ece96de2374b7b37be72aeeb7b
SHA512

8b6c7470460f0134db6d3ce8bcb9b089cce4636cb1d55a3277466e8c45f654228d9026162a1302555746577e00d4ef6b0c9e01cf79f1f1824801595b2ce0e27d

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of SetThreadContext 1 IoCs

Processes:

1811acc99aa3297467e8a83676093cecf1afb3ece96de2374b7b37be72aeeb7b.exe

description	pid	process	target process
PID 3544 set thread context of 3676	3544	1811acc99aa3297467e8a83676093cecf1afb3ece96de2374b7b37be72aeeb7b.exe	1811acc99aa3297467e8a83676093cecf1afb3ece96de2374b7b37be72aeeb7b.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4100 3676 WerFault.exe 1811acc99aa3297467e8a83676093cecf1afb3ece96de2374b7b37be72aeeb7b.exe

pid	pid_target	process	target process
4100	3676	WerFault.exe	1811acc99aa3297467e8a83676093cecf1afb3ece96de2374b7b37be72aeeb7b.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

1811acc99aa3297467e8a83676093cecf1afb3ece96de2374b7b37be72aeeb7b.exe

description	pid	process	target process
PID 3544 wrote to memory of 3676	3544	1811acc99aa3297467e8a83676093cecf1afb3ece96de2374b7b37be72aeeb7b.exe	1811acc99aa3297467e8a83676093cecf1afb3ece96de2374b7b37be72aeeb7b.exe
PID 3544 wrote to memory of 3676	3544	1811acc99aa3297467e8a83676093cecf1afb3ece96de2374b7b37be72aeeb7b.exe	1811acc99aa3297467e8a83676093cecf1afb3ece96de2374b7b37be72aeeb7b.exe
PID 3544 wrote to memory of 3676	3544	1811acc99aa3297467e8a83676093cecf1afb3ece96de2374b7b37be72aeeb7b.exe	1811acc99aa3297467e8a83676093cecf1afb3ece96de2374b7b37be72aeeb7b.exe
PID 3544 wrote to memory of 3676	3544	1811acc99aa3297467e8a83676093cecf1afb3ece96de2374b7b37be72aeeb7b.exe	1811acc99aa3297467e8a83676093cecf1afb3ece96de2374b7b37be72aeeb7b.exe
PID 3544 wrote to memory of 3676	3544	1811acc99aa3297467e8a83676093cecf1afb3ece96de2374b7b37be72aeeb7b.exe	1811acc99aa3297467e8a83676093cecf1afb3ece96de2374b7b37be72aeeb7b.exe
PID 3544 wrote to memory of 3676	3544	1811acc99aa3297467e8a83676093cecf1afb3ece96de2374b7b37be72aeeb7b.exe	1811acc99aa3297467e8a83676093cecf1afb3ece96de2374b7b37be72aeeb7b.exe
PID 3544 wrote to memory of 3676	3544	1811acc99aa3297467e8a83676093cecf1afb3ece96de2374b7b37be72aeeb7b.exe	1811acc99aa3297467e8a83676093cecf1afb3ece96de2374b7b37be72aeeb7b.exe
PID 3544 wrote to memory of 3676	3544	1811acc99aa3297467e8a83676093cecf1afb3ece96de2374b7b37be72aeeb7b.exe	1811acc99aa3297467e8a83676093cecf1afb3ece96de2374b7b37be72aeeb7b.exe
PID 3544 wrote to memory of 3676	3544	1811acc99aa3297467e8a83676093cecf1afb3ece96de2374b7b37be72aeeb7b.exe	1811acc99aa3297467e8a83676093cecf1afb3ece96de2374b7b37be72aeeb7b.exe

C:\Users\Admin\AppData\Local\Temp\1811acc99aa3297467e8a83676093cecf1afb3ece96de2374b7b37be72aeeb7b.exe
"C:\Users\Admin\AppData\Local\Temp\1811acc99aa3297467e8a83676093cecf1afb3ece96de2374b7b37be72aeeb7b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3544

C:\Users\Admin\AppData\Local\Temp\1811acc99aa3297467e8a83676093cecf1afb3ece96de2374b7b37be72aeeb7b.exe
"C:\Users\Admin\AppData\Local\Temp\1811acc99aa3297467e8a83676093cecf1afb3ece96de2374b7b37be72aeeb7b.exe"
2⤵
PID:3676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 28
3⤵
- Program crash
PID:4100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3676-115-0x0000000029A00000-0x0000000029A1E000-memory.dmp

Filesize
120KB

Download
memory/3676-116-0x0000000029A00000-0x0000000029A1E000-memory.dmp

Filesize
120KB

Download
memory/3676-117-0x0000000029A00000-0x0000000029A1E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing