metasploit | 227e8678d85bff501bb909e0d61ee25554bf99c94e47c0194da53e7c246687f9

General

Target

227e8678d85bff501bb909e0d61ee25554bf99c94e47c0194da53e7c246687f9.exe
Size

1.0MB
MD5

af064499da08c11936e3c1d66acae650
SHA1

8cb2db16546062d3b262a61c5a9c1f025662f19d
SHA256

227e8678d85bff501bb909e0d61ee25554bf99c94e47c0194da53e7c246687f9
SHA512

0540d3fdaf5a0d8ea05647bca0967467725148dc8fe7f97705218000fa38bbad4d31abc03cfd2ba0bb532c73cdebec53f9a78e83b5488e3b59a6458afd5edbd2

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of SetThreadContext 1 IoCs

Processes:

227e8678d85bff501bb909e0d61ee25554bf99c94e47c0194da53e7c246687f9.exe

description	pid	process	target process
PID 792 set thread context of 1664	792	227e8678d85bff501bb909e0d61ee25554bf99c94e47c0194da53e7c246687f9.exe	227e8678d85bff501bb909e0d61ee25554bf99c94e47c0194da53e7c246687f9.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

227e8678d85bff501bb909e0d61ee25554bf99c94e47c0194da53e7c246687f9.exe

description	pid	process	target process
PID 792 wrote to memory of 1664	792	227e8678d85bff501bb909e0d61ee25554bf99c94e47c0194da53e7c246687f9.exe	227e8678d85bff501bb909e0d61ee25554bf99c94e47c0194da53e7c246687f9.exe
PID 792 wrote to memory of 1664	792	227e8678d85bff501bb909e0d61ee25554bf99c94e47c0194da53e7c246687f9.exe	227e8678d85bff501bb909e0d61ee25554bf99c94e47c0194da53e7c246687f9.exe
PID 792 wrote to memory of 1664	792	227e8678d85bff501bb909e0d61ee25554bf99c94e47c0194da53e7c246687f9.exe	227e8678d85bff501bb909e0d61ee25554bf99c94e47c0194da53e7c246687f9.exe
PID 792 wrote to memory of 1664	792	227e8678d85bff501bb909e0d61ee25554bf99c94e47c0194da53e7c246687f9.exe	227e8678d85bff501bb909e0d61ee25554bf99c94e47c0194da53e7c246687f9.exe
PID 792 wrote to memory of 1664	792	227e8678d85bff501bb909e0d61ee25554bf99c94e47c0194da53e7c246687f9.exe	227e8678d85bff501bb909e0d61ee25554bf99c94e47c0194da53e7c246687f9.exe
PID 792 wrote to memory of 1664	792	227e8678d85bff501bb909e0d61ee25554bf99c94e47c0194da53e7c246687f9.exe	227e8678d85bff501bb909e0d61ee25554bf99c94e47c0194da53e7c246687f9.exe
PID 792 wrote to memory of 1664	792	227e8678d85bff501bb909e0d61ee25554bf99c94e47c0194da53e7c246687f9.exe	227e8678d85bff501bb909e0d61ee25554bf99c94e47c0194da53e7c246687f9.exe
PID 792 wrote to memory of 1664	792	227e8678d85bff501bb909e0d61ee25554bf99c94e47c0194da53e7c246687f9.exe	227e8678d85bff501bb909e0d61ee25554bf99c94e47c0194da53e7c246687f9.exe
PID 792 wrote to memory of 1664	792	227e8678d85bff501bb909e0d61ee25554bf99c94e47c0194da53e7c246687f9.exe	227e8678d85bff501bb909e0d61ee25554bf99c94e47c0194da53e7c246687f9.exe
PID 792 wrote to memory of 1664	792	227e8678d85bff501bb909e0d61ee25554bf99c94e47c0194da53e7c246687f9.exe	227e8678d85bff501bb909e0d61ee25554bf99c94e47c0194da53e7c246687f9.exe

C:\Users\Admin\AppData\Local\Temp\227e8678d85bff501bb909e0d61ee25554bf99c94e47c0194da53e7c246687f9.exe
"C:\Users\Admin\AppData\Local\Temp\227e8678d85bff501bb909e0d61ee25554bf99c94e47c0194da53e7c246687f9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:792

C:\Users\Admin\AppData\Local\Temp\227e8678d85bff501bb909e0d61ee25554bf99c94e47c0194da53e7c246687f9.exe
"C:\Users\Admin\AppData\Local\Temp\227e8678d85bff501bb909e0d61ee25554bf99c94e47c0194da53e7c246687f9.exe"
2⤵
PID:1664

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/792-55-0x0000000075321000-0x0000000075323000-memory.dmp

Filesize
8KB

Download
memory/1664-56-0x0000000029A00000-0x0000000029A1E000-memory.dmp

Filesize
120KB

Download
memory/1664-57-0x0000000029A00000-0x0000000029A1E000-memory.dmp

Filesize
120KB

Download
memory/1664-58-0x0000000029A00000-0x0000000029A1E000-memory.dmp

Filesize
120KB

Download
memory/1664-60-0x0000000029A00000-0x0000000029A1E000-memory.dmp

Filesize
120KB

Download
memory/1664-62-0x0000000029A00000-0x0000000029A1E000-memory.dmp

Filesize
120KB

Download
memory/1664-63-0x0000000029A00000-0x0000000029A1E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing