metasploit | 13f012a663fbfae0ca7ba276500bbe867edc5c59ef7c99863859701bb5bd3d1b | Triage

Analysis

max time kernel
39s
max time network
60s
platform
windows7_x64
resource
win7-20220414-en
submitted
11-05-2022 02:05

Sharing

Report Analysis Logs

General

Target

13f012a663fbfae0ca7ba276500bbe867edc5c59ef7c99863859701bb5bd3d1b.exe
Size

10KB
MD5

3a6c43e4625afc798831b4cf84c2cc99
SHA1

697669b40cf6caa8fe194a701ca5969639bf7d71
SHA256

13f012a663fbfae0ca7ba276500bbe867edc5c59ef7c99863859701bb5bd3d1b
SHA512

df745c4e1fed944c87f9ec18251330f6da2a9dfa1c20734e8541b820ce3bc59396228a3cc66539a77e923f1d592ac4c72122e965c79e3ff87893a25c94a800fc

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

47.96.122.196:12580

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

13f012a663fbfae0ca7ba276500bbe867edc5c59ef7c99863859701bb5bd3d1b.exe

description	pid	process	target process
PID 1652 wrote to memory of 584	1652	13f012a663fbfae0ca7ba276500bbe867edc5c59ef7c99863859701bb5bd3d1b.exe	svchost.exe
PID 1652 wrote to memory of 584	1652	13f012a663fbfae0ca7ba276500bbe867edc5c59ef7c99863859701bb5bd3d1b.exe	svchost.exe
PID 1652 wrote to memory of 584	1652	13f012a663fbfae0ca7ba276500bbe867edc5c59ef7c99863859701bb5bd3d1b.exe	svchost.exe
PID 1652 wrote to memory of 584	1652	13f012a663fbfae0ca7ba276500bbe867edc5c59ef7c99863859701bb5bd3d1b.exe	svchost.exe
PID 1652 wrote to memory of 584	1652	13f012a663fbfae0ca7ba276500bbe867edc5c59ef7c99863859701bb5bd3d1b.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\13f012a663fbfae0ca7ba276500bbe867edc5c59ef7c99863859701bb5bd3d1b.exe
"C:\Users\Admin\AppData\Local\Temp\13f012a663fbfae0ca7ba276500bbe867edc5c59ef7c99863859701bb5bd3d1b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
PID:584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/584-54-0x0000000000000000-mapping.dmp

Download