metasploit | 3fa98e5083ee3e162e70b81eabf2275a50a2e27cb11a7b14f18be951a8be3c12

General

Target

3fa98e5083ee3e162e70b81eabf2275a50a2e27cb11a7b14f18be951a8be3c12.exe
Size

98KB
MD5

9c7f5c15b94e9e1ad1301ffe3e69424f
SHA1

b53adf7466534f9c0ec06f3ee9cf16f629b665ca
SHA256

3fa98e5083ee3e162e70b81eabf2275a50a2e27cb11a7b14f18be951a8be3c12
SHA512

456ae297445a7b0c92a3f2fd913c335e1d4085d9e54259ac1f27db18994669d6202cbb02fa2944bd58dd0e623a317c8a70801d7f2e3c82d4feb509a15025206a

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of SetThreadContext 1 IoCs

Processes:

3fa98e5083ee3e162e70b81eabf2275a50a2e27cb11a7b14f18be951a8be3c12.exe

description	pid	process	target process
PID 1488 set thread context of 1656	1488	3fa98e5083ee3e162e70b81eabf2275a50a2e27cb11a7b14f18be951a8be3c12.exe	3fa98e5083ee3e162e70b81eabf2275a50a2e27cb11a7b14f18be951a8be3c12.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4896 1656 WerFault.exe 3fa98e5083ee3e162e70b81eabf2275a50a2e27cb11a7b14f18be951a8be3c12.exe

pid	pid_target	process	target process
4896	1656	WerFault.exe	3fa98e5083ee3e162e70b81eabf2275a50a2e27cb11a7b14f18be951a8be3c12.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

3fa98e5083ee3e162e70b81eabf2275a50a2e27cb11a7b14f18be951a8be3c12.exe

description	pid	process	target process
PID 1488 wrote to memory of 1656	1488	3fa98e5083ee3e162e70b81eabf2275a50a2e27cb11a7b14f18be951a8be3c12.exe	3fa98e5083ee3e162e70b81eabf2275a50a2e27cb11a7b14f18be951a8be3c12.exe
PID 1488 wrote to memory of 1656	1488	3fa98e5083ee3e162e70b81eabf2275a50a2e27cb11a7b14f18be951a8be3c12.exe	3fa98e5083ee3e162e70b81eabf2275a50a2e27cb11a7b14f18be951a8be3c12.exe
PID 1488 wrote to memory of 1656	1488	3fa98e5083ee3e162e70b81eabf2275a50a2e27cb11a7b14f18be951a8be3c12.exe	3fa98e5083ee3e162e70b81eabf2275a50a2e27cb11a7b14f18be951a8be3c12.exe
PID 1488 wrote to memory of 1656	1488	3fa98e5083ee3e162e70b81eabf2275a50a2e27cb11a7b14f18be951a8be3c12.exe	3fa98e5083ee3e162e70b81eabf2275a50a2e27cb11a7b14f18be951a8be3c12.exe
PID 1488 wrote to memory of 1656	1488	3fa98e5083ee3e162e70b81eabf2275a50a2e27cb11a7b14f18be951a8be3c12.exe	3fa98e5083ee3e162e70b81eabf2275a50a2e27cb11a7b14f18be951a8be3c12.exe
PID 1488 wrote to memory of 1656	1488	3fa98e5083ee3e162e70b81eabf2275a50a2e27cb11a7b14f18be951a8be3c12.exe	3fa98e5083ee3e162e70b81eabf2275a50a2e27cb11a7b14f18be951a8be3c12.exe
PID 1488 wrote to memory of 1656	1488	3fa98e5083ee3e162e70b81eabf2275a50a2e27cb11a7b14f18be951a8be3c12.exe	3fa98e5083ee3e162e70b81eabf2275a50a2e27cb11a7b14f18be951a8be3c12.exe
PID 1488 wrote to memory of 1656	1488	3fa98e5083ee3e162e70b81eabf2275a50a2e27cb11a7b14f18be951a8be3c12.exe	3fa98e5083ee3e162e70b81eabf2275a50a2e27cb11a7b14f18be951a8be3c12.exe
PID 1488 wrote to memory of 1656	1488	3fa98e5083ee3e162e70b81eabf2275a50a2e27cb11a7b14f18be951a8be3c12.exe	3fa98e5083ee3e162e70b81eabf2275a50a2e27cb11a7b14f18be951a8be3c12.exe

C:\Users\Admin\AppData\Local\Temp\3fa98e5083ee3e162e70b81eabf2275a50a2e27cb11a7b14f18be951a8be3c12.exe
"C:\Users\Admin\AppData\Local\Temp\3fa98e5083ee3e162e70b81eabf2275a50a2e27cb11a7b14f18be951a8be3c12.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1488

C:\Users\Admin\AppData\Local\Temp\3fa98e5083ee3e162e70b81eabf2275a50a2e27cb11a7b14f18be951a8be3c12.exe
"C:\Users\Admin\AppData\Local\Temp\3fa98e5083ee3e162e70b81eabf2275a50a2e27cb11a7b14f18be951a8be3c12.exe"
2⤵
PID:1656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 12
3⤵
- Program crash
PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1656 -ip 1656
1⤵
PID:4740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1656-130-0x0000000000000000-mapping.dmp

Download
memory/1656-131-0x0000000029A00000-0x0000000029A24000-memory.dmp

Filesize
144KB

Download
memory/1656-132-0x0000000029A00000-0x0000000029A24000-memory.dmp

Filesize
144KB

Download
memory/1656-133-0x0000000029A00000-0x0000000029A24000-memory.dmp

Filesize
144KB

Download
memory/1656-134-0x0000000029A00000-0x0000000029A24000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing