metasploit | 5f3916cde8f3852fc370be7442e668f31a0d676f2ae912f88042481f972cc26a

Analysis

Target

e79d48bc650a2e1bd36d73f438826b8d.exe
Size

71KB
MD5

e79d48bc650a2e1bd36d73f438826b8d
SHA1

191e1644ca6b40fd8469d8013e4f931ac9877c18
SHA256

5f3916cde8f3852fc370be7442e668f31a0d676f2ae912f88042481f972cc26a
SHA512

7451442c8ff56ce0124efe429afbba480c71e56247f5cbebe83a0aa7107e9e3c3f68e891dfa928d1fc47be8c5fd715f59ebd252cf4d3d06f1eb471f6d422948d

Score

10^/10

Family

metasploit

Version

metasploit_stager

51.75.89.111:50438

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
suricata: ET MALWARE Possible Metasploit Payload Common Construct Bind_API (from server)
suricata: ET MALWARE Possible Metasploit Payload Common Construct Bind_API (from server)
suricata

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e79d48bc650a2e1bd36d73f438826b8d.exe

description	pid	process	target process
PID 664 wrote to memory of 1908	664	e79d48bc650a2e1bd36d73f438826b8d.exe	svchost.exe
PID 664 wrote to memory of 1908	664	e79d48bc650a2e1bd36d73f438826b8d.exe	svchost.exe
PID 664 wrote to memory of 1908	664	e79d48bc650a2e1bd36d73f438826b8d.exe	svchost.exe
PID 664 wrote to memory of 1908	664	e79d48bc650a2e1bd36d73f438826b8d.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\e79d48bc650a2e1bd36d73f438826b8d.exe
"C:\Users\Admin\AppData\Local\Temp\e79d48bc650a2e1bd36d73f438826b8d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:664

memory/1908-54-0x0000000000000000-mapping.dmp

Download
memory/1908-55-0x0000000000190000-0x00000000001C5000-memory.dmp

Filesize
212KB

Download
memory/1908-56-0x00000000001D0000-0x000000000020B000-memory.dmp

Filesize
236KB

Download
memory/1908-58-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/1908-59-0x00000000003D0000-0x000000000042F000-memory.dmp

Filesize
380KB

Download
memory/1908-60-0x00000000004E9000-0x0000000000584000-memory.dmp

Filesize
620KB

Download
memory/1908-61-0x0000000000508000-0x000000000052A000-memory.dmp

Filesize
136KB

Download
memory/1908-62-0x0000000000210000-0x0000000000237000-memory.dmp

Filesize
156KB

Download
memory/1908-63-0x00000000001D0000-0x000000000020B000-memory.dmp

Filesize
236KB

Download
memory/1908-64-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download