metasploit | cfd3d68fdcdcb3e629ecee1612d87a3b69dca38e266dbad2f6e71859254f2a73 | Triage

Analysis

max time kernel
135s
max time network
148s
platform
windows7_x64
resource
win7-20220414-en
submitted
14-06-2022 15:26

Sharing

Report Analysis Logs

General

Target

tmp.exe
Size

72KB
MD5

04cf8f97769f71408280158795d8e309
SHA1

2c26c24ab7b02267ef6bd7aa71cbbccfd07ddbff
SHA256

cfd3d68fdcdcb3e629ecee1612d87a3b69dca38e266dbad2f6e71859254f2a73
SHA512

3d07e553d00111624e9993414dece4c6fba3428eeaa4dc042ca4dea5b024eb8f201002a812c3bef26aa170ebeed98735a8708dc112f89a96567fa3db29dafd18

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

10.211.55.2:3333

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

tmp.exe

description	pid	process	target process
PID 960 wrote to memory of 948	960	tmp.exe	svchost.exe
PID 960 wrote to memory of 948	960	tmp.exe	svchost.exe
PID 960 wrote to memory of 948	960	tmp.exe	svchost.exe
PID 960 wrote to memory of 948	960	tmp.exe	svchost.exe
PID 960 wrote to memory of 948	960	tmp.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
PID:948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/948-54-0x0000000000000000-mapping.dmp

Download