metasploit | 260130cfd39bd76476002473fd59c377563641c6eab229517d7744417f90cf07 | Triage

Analysis

max time kernel
172s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
11-06-2022 17:16

Sharing

Report Analysis Logs

General

Target

260130cfd39bd76476002473fd59c377563641c6eab229517d7744417f90cf07.dll
Size

17KB
MD5

e16f1a12b2e8bba5c13dd8bec55f80c1
SHA1

c243b337c0b6190b385df417cd53571ccc03a4bb
SHA256

260130cfd39bd76476002473fd59c377563641c6eab229517d7744417f90cf07
SHA512

2362bee14bb4cb0397069803c0d7d93469602b7c19afbfa1a18cb70de687cc7dea5285a1b0e94c446ceb893edbfa4077db0799f5fac9cad05861fe39e526cb58

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://192.168.50.66:8080/n7Av

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4268 wrote to memory of 4668	4268	regsvr32.exe	rundll32.exe
PID 4268 wrote to memory of 4668	4268	regsvr32.exe	rundll32.exe
PID 4268 wrote to memory of 4668	4268	regsvr32.exe	rundll32.exe
PID 4268 wrote to memory of 4668	4268	regsvr32.exe	rundll32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\260130cfd39bd76476002473fd59c377563641c6eab229517d7744417f90cf07.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4268

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe
2⤵
PID:4668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4668-130-0x0000000001080000-0x0000000001081000-memory.dmp

Filesize
4KB

Download