metasploit | 28435fa2051fa4bf5425d52b5c1b16781e4b2553be726b152796eaf9d1d49581

Analysis

Target

28435fa2051fa4bf5425d52b5c1b16781e4b2553be726b152796eaf9d1d49581.exe
Size

2.9MB
MD5

6056cb47164323c9bacfea777afffe0f
SHA1

678e3415cad90165942024bb1a00a886685f1b83
SHA256

28435fa2051fa4bf5425d52b5c1b16781e4b2553be726b152796eaf9d1d49581
SHA512

5616f5cc04221b676cdb21ae2c3283fbb64f8435c5ab18ba9f310f916675c5ba0b919fa03e2bba79da346cea6a0ece0b385866916a77ee941152becac8c842d8

Score

10^/10

Family

metasploit

Version

windows/shell_reverse_tcp

192.168.10.3:5555

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
2304	4332	WerFault.exe	28435fa2051fa4bf5425d52b5c1b16781e4b2553be726b152796eaf9d1d49581.exe
2804	4332	WerFault.exe	28435fa2051fa4bf5425d52b5c1b16781e4b2553be726b152796eaf9d1d49581.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

28435fa2051fa4bf5425d52b5c1b16781e4b2553be726b152796eaf9d1d49581.exe

description	pid	process	target process
PID 4332 wrote to memory of 2304	4332	28435fa2051fa4bf5425d52b5c1b16781e4b2553be726b152796eaf9d1d49581.exe	WerFault.exe
PID 4332 wrote to memory of 2304	4332	28435fa2051fa4bf5425d52b5c1b16781e4b2553be726b152796eaf9d1d49581.exe	WerFault.exe
PID 4332 wrote to memory of 2304	4332	28435fa2051fa4bf5425d52b5c1b16781e4b2553be726b152796eaf9d1d49581.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\28435fa2051fa4bf5425d52b5c1b16781e4b2553be726b152796eaf9d1d49581.exe
"C:\Users\Admin\AppData\Local\Temp\28435fa2051fa4bf5425d52b5c1b16781e4b2553be726b152796eaf9d1d49581.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 384
2⤵
- Program crash
PID:2304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 384
2⤵
- Program crash
PID:2804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 4332 -ip 4332
1⤵
PID:1664

memory/2304-131-0x0000000000000000-mapping.dmp

Download
memory/4332-130-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4332-132-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download