metasploit | 209124930bca4d5656d962b9593ddd30bed89c3b31cddb9ad7ecbedf25813e02 | Triage

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220414-en
submitted
30-06-2022 16:54

Sharing

Report Analysis Logs

General

Target

209124930bca4d5656d962b9593ddd30bed89c3b31cddb9ad7ecbedf25813e02.exe
Size

233KB
MD5

a81a20d413466c583e6bd83a65b1d298
SHA1

a47c3bc1cfec829f8b55d9b27f24bfe8a537f49a
SHA256

209124930bca4d5656d962b9593ddd30bed89c3b31cddb9ad7ecbedf25813e02
SHA512

656e9ab2eb4adb78d5d2c22fd4e3437a211e3c1c501a61d4f12ca375e553b3a2d2cab640ac02e29dbce484e94e1e5b2a73b79107db3d1d397df33ccb86292703

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1912 1488 WerFault.exe 209124930bca4d5656d962b9593ddd30bed89c3b31cddb9ad7ecbedf25813e02.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

209124930bca4d5656d962b9593ddd30bed89c3b31cddb9ad7ecbedf25813e02.exe

description	pid	process	target process
PID 1488 wrote to memory of 1912	1488	209124930bca4d5656d962b9593ddd30bed89c3b31cddb9ad7ecbedf25813e02.exe	WerFault.exe
PID 1488 wrote to memory of 1912	1488	209124930bca4d5656d962b9593ddd30bed89c3b31cddb9ad7ecbedf25813e02.exe	WerFault.exe
PID 1488 wrote to memory of 1912	1488	209124930bca4d5656d962b9593ddd30bed89c3b31cddb9ad7ecbedf25813e02.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\209124930bca4d5656d962b9593ddd30bed89c3b31cddb9ad7ecbedf25813e02.exe
"C:\Users\Admin\AppData\Local\Temp\209124930bca4d5656d962b9593ddd30bed89c3b31cddb9ad7ecbedf25813e02.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1488

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1488 -s 40
2⤵
- Program crash
PID:1912

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1488-55-0x00000000003D0000-0x00000000003ED000-memory.dmp

Filesize
116KB

Download
memory/1912-54-0x0000000000000000-mapping.dmp

Download