metasploit | 2fd38911f08f6ebd447c6f7466ea6cbf9dfd472a3fd20b7ac9cdf1d3cbed0e35

General

Target

2fd38911f08f6ebd447c6f7466ea6cbf9dfd472a3fd20b7ac9cdf1d3cbed0e35.exe
Size

1.2MB
MD5

3c28605ba9465db98e45a4dc89909304
SHA1

0884f9c59ffa2039f3b9ef663cfadf080d00c150
SHA256

2fd38911f08f6ebd447c6f7466ea6cbf9dfd472a3fd20b7ac9cdf1d3cbed0e35
SHA512

87c03f7fbb010804d4d6c9b69ca6b8b9b8d924cadcf7b4f09125efb8119c2264c8fef8f5a8b9a73c2f232d4c480f7dcdddb7ed1e475b5c17a6ebb35594cca80d

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of SetThreadContext 1 IoCs

Processes:

2fd38911f08f6ebd447c6f7466ea6cbf9dfd472a3fd20b7ac9cdf1d3cbed0e35.exe

description	pid	process	target process
PID 1700 set thread context of 836	1700	2fd38911f08f6ebd447c6f7466ea6cbf9dfd472a3fd20b7ac9cdf1d3cbed0e35.exe	2fd38911f08f6ebd447c6f7466ea6cbf9dfd472a3fd20b7ac9cdf1d3cbed0e35.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

2fd38911f08f6ebd447c6f7466ea6cbf9dfd472a3fd20b7ac9cdf1d3cbed0e35.exe

description	pid	process	target process
PID 1700 wrote to memory of 836	1700	2fd38911f08f6ebd447c6f7466ea6cbf9dfd472a3fd20b7ac9cdf1d3cbed0e35.exe	2fd38911f08f6ebd447c6f7466ea6cbf9dfd472a3fd20b7ac9cdf1d3cbed0e35.exe
PID 1700 wrote to memory of 836	1700	2fd38911f08f6ebd447c6f7466ea6cbf9dfd472a3fd20b7ac9cdf1d3cbed0e35.exe	2fd38911f08f6ebd447c6f7466ea6cbf9dfd472a3fd20b7ac9cdf1d3cbed0e35.exe
PID 1700 wrote to memory of 836	1700	2fd38911f08f6ebd447c6f7466ea6cbf9dfd472a3fd20b7ac9cdf1d3cbed0e35.exe	2fd38911f08f6ebd447c6f7466ea6cbf9dfd472a3fd20b7ac9cdf1d3cbed0e35.exe
PID 1700 wrote to memory of 836	1700	2fd38911f08f6ebd447c6f7466ea6cbf9dfd472a3fd20b7ac9cdf1d3cbed0e35.exe	2fd38911f08f6ebd447c6f7466ea6cbf9dfd472a3fd20b7ac9cdf1d3cbed0e35.exe
PID 1700 wrote to memory of 836	1700	2fd38911f08f6ebd447c6f7466ea6cbf9dfd472a3fd20b7ac9cdf1d3cbed0e35.exe	2fd38911f08f6ebd447c6f7466ea6cbf9dfd472a3fd20b7ac9cdf1d3cbed0e35.exe
PID 1700 wrote to memory of 836	1700	2fd38911f08f6ebd447c6f7466ea6cbf9dfd472a3fd20b7ac9cdf1d3cbed0e35.exe	2fd38911f08f6ebd447c6f7466ea6cbf9dfd472a3fd20b7ac9cdf1d3cbed0e35.exe
PID 1700 wrote to memory of 836	1700	2fd38911f08f6ebd447c6f7466ea6cbf9dfd472a3fd20b7ac9cdf1d3cbed0e35.exe	2fd38911f08f6ebd447c6f7466ea6cbf9dfd472a3fd20b7ac9cdf1d3cbed0e35.exe
PID 1700 wrote to memory of 836	1700	2fd38911f08f6ebd447c6f7466ea6cbf9dfd472a3fd20b7ac9cdf1d3cbed0e35.exe	2fd38911f08f6ebd447c6f7466ea6cbf9dfd472a3fd20b7ac9cdf1d3cbed0e35.exe
PID 1700 wrote to memory of 836	1700	2fd38911f08f6ebd447c6f7466ea6cbf9dfd472a3fd20b7ac9cdf1d3cbed0e35.exe	2fd38911f08f6ebd447c6f7466ea6cbf9dfd472a3fd20b7ac9cdf1d3cbed0e35.exe
PID 1700 wrote to memory of 836	1700	2fd38911f08f6ebd447c6f7466ea6cbf9dfd472a3fd20b7ac9cdf1d3cbed0e35.exe	2fd38911f08f6ebd447c6f7466ea6cbf9dfd472a3fd20b7ac9cdf1d3cbed0e35.exe

C:\Users\Admin\AppData\Local\Temp\2fd38911f08f6ebd447c6f7466ea6cbf9dfd472a3fd20b7ac9cdf1d3cbed0e35.exe
"C:\Users\Admin\AppData\Local\Temp\2fd38911f08f6ebd447c6f7466ea6cbf9dfd472a3fd20b7ac9cdf1d3cbed0e35.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1700

C:\Users\Admin\AppData\Local\Temp\2fd38911f08f6ebd447c6f7466ea6cbf9dfd472a3fd20b7ac9cdf1d3cbed0e35.exe
"C:\Users\Admin\AppData\Local\Temp\2fd38911f08f6ebd447c6f7466ea6cbf9dfd472a3fd20b7ac9cdf1d3cbed0e35.exe"
2⤵
PID:836

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/836-55-0x0000000029A00000-0x0000000029A1E000-memory.dmp

Filesize
120KB

Download
memory/836-56-0x0000000029A00000-0x0000000029A1E000-memory.dmp

Filesize
120KB

Download
memory/836-57-0x0000000029A00000-0x0000000029A1E000-memory.dmp

Filesize
120KB

Download
memory/836-59-0x0000000029A00000-0x0000000029A1E000-memory.dmp

Filesize
120KB

Download
memory/836-61-0x0000000029A00000-0x0000000029A1E000-memory.dmp

Filesize
120KB

Download
memory/836-62-0x0000000029A00000-0x0000000029A1E000-memory.dmp

Filesize
120KB

Download
memory/1700-54-0x0000000075F91000-0x0000000075F93000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing