metasploit | e7e3065bd1361df0190372fd389d071de4aa43d47f0b693142109bb24cae7337 | Triage

Analysis

max time kernel
205s
max time network
217s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12-05-2022 11:37

Sharing

Report Analysis Logs

General

Target

e7e3065bd1361df0190372fd389d071de4aa43d47f0b693142109bb24cae7337.exe
Size

1.9MB
MD5

e7a799bc9d88bd56e08ca76036908332
SHA1

c68ff8e0c91cff087646eb1ea34db77f0f719a33
SHA256

e7e3065bd1361df0190372fd389d071de4aa43d47f0b693142109bb24cae7337
SHA512

2aac2535446287420bd32b565e34d7979d38cd9ca54e9f6a7505a5fd359a5b00d8f78ea0e69559acf10066fac33df77d3f397342b406e6d50dc8fafcfca5b1e9

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://8.210.39.131:443/VClW

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

e7e3065bd1361df0190372fd389d071de4aa43d47f0b693142109bb24cae7337.exe

pid	process
1648	e7e3065bd1361df0190372fd389d071de4aa43d47f0b693142109bb24cae7337.exe
1648	e7e3065bd1361df0190372fd389d071de4aa43d47f0b693142109bb24cae7337.exe

C:\Users\Admin\AppData\Local\Temp\e7e3065bd1361df0190372fd389d071de4aa43d47f0b693142109bb24cae7337.exe
"C:\Users\Admin\AppData\Local\Temp\e7e3065bd1361df0190372fd389d071de4aa43d47f0b693142109bb24cae7337.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1648-130-0x00000000008BA000-0x00000000008CF000-memory.dmp

Filesize
84KB

Download
memory/1648-131-0x00000000008C6000-0x00000000008C8000-memory.dmp

Filesize
8KB

Download