metasploit | 1de24c0661003b0efde67a2bc86fd4b66ccf13892c72379ea244f647af1e9288 | Triage

Analysis

max time kernel
134s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12-06-2022 23:06

Sharing

Report Analysis Logs

General

Target

1de24c0661003b0efde67a2bc86fd4b66ccf13892c72379ea244f647af1e9288.exe
Size

311KB
MD5

df211d94b0d76082593b452af98f5af6
SHA1

c37319dc260c4c58901f556e8dc4c0a7a57fda41
SHA256

1de24c0661003b0efde67a2bc86fd4b66ccf13892c72379ea244f647af1e9288
SHA512

5f048b52efa626ad2c494afd392559e58a05717d63900f4994588d377a45e74edcdf424cb1df0ece96a0d94efa15d9d9af051210f8be680419522e47da465f2e

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
2684	4240	WerFault.exe	1de24c0661003b0efde67a2bc86fd4b66ccf13892c72379ea244f647af1e9288.exe
3148	4240	WerFault.exe	1de24c0661003b0efde67a2bc86fd4b66ccf13892c72379ea244f647af1e9288.exe

C:\Users\Admin\AppData\Local\Temp\1de24c0661003b0efde67a2bc86fd4b66ccf13892c72379ea244f647af1e9288.exe
"C:\Users\Admin\AppData\Local\Temp\1de24c0661003b0efde67a2bc86fd4b66ccf13892c72379ea244f647af1e9288.exe"
1⤵
PID:4240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4240 -s 660
2⤵
- Program crash
PID:2684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4240 -s 668
2⤵
- Program crash
PID:3148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4240 -ip 4240
1⤵
PID:1924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4240 -ip 4240
1⤵
PID:4820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4240-130-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4240-131-0x0000000000A90000-0x0000000000AF0000-memory.dmp

Filesize
384KB

Download
memory/4240-132-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4240-133-0x0000000000A90000-0x0000000000AF0000-memory.dmp

Filesize
384KB

Download