metasploit | e7e3065bd1361df0190372fd389d071de4aa43d47f0b693142109bb24cae7337 | Triage

Analysis

max time kernel
64s
max time network
64s
platform
windows7_x64
resource
win7-20220414-en
submitted
12-05-2022 11:37

Sharing

Report Analysis Logs

General

Target

e7e3065bd1361df0190372fd389d071de4aa43d47f0b693142109bb24cae7337.exe
Size

1.9MB
MD5

e7a799bc9d88bd56e08ca76036908332
SHA1

c68ff8e0c91cff087646eb1ea34db77f0f719a33
SHA256

e7e3065bd1361df0190372fd389d071de4aa43d47f0b693142109bb24cae7337
SHA512

2aac2535446287420bd32b565e34d7979d38cd9ca54e9f6a7505a5fd359a5b00d8f78ea0e69559acf10066fac33df77d3f397342b406e6d50dc8fafcfca5b1e9

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://8.210.39.131:443/VClW

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

e7e3065bd1361df0190372fd389d071de4aa43d47f0b693142109bb24cae7337.exe

pid	process
1788	e7e3065bd1361df0190372fd389d071de4aa43d47f0b693142109bb24cae7337.exe
1788	e7e3065bd1361df0190372fd389d071de4aa43d47f0b693142109bb24cae7337.exe

C:\Users\Admin\AppData\Local\Temp\e7e3065bd1361df0190372fd389d071de4aa43d47f0b693142109bb24cae7337.exe
"C:\Users\Admin\AppData\Local\Temp\e7e3065bd1361df0190372fd389d071de4aa43d47f0b693142109bb24cae7337.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1788-54-0x00000000763B1000-0x00000000763B3000-memory.dmp

Filesize
8KB

Download
memory/1788-55-0x0000000000481000-0x00000000004A6000-memory.dmp

Filesize
148KB

Download