metasploit | 4a90cac96c04e3cf0b797290dbcc1403d36fd6a6fa26e87c865283ec4086621b

Analysis

max time kernel
22s
max time network
26s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12-07-2022 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a90cac96c04e3cf0b797290dbcc1403d36fd6a6fa26e87c865283ec4086621b.exe
Size

79KB
MD5

c82d0e4f5eab0bc5c26f79628cbef4fc
SHA1

68e68a909a04803528d156b4705567164c221270
SHA256

4a90cac96c04e3cf0b797290dbcc1403d36fd6a6fa26e87c865283ec4086621b
SHA512

8a272a263ce742b84c1a99ae5073a735c71381257382811914f995aaf7f04d24bff669116786b113a9b2c6ca5400523acb7a69fa89d2f135af593673055ead8a

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of SetThreadContext 1 IoCs

Processes:

4a90cac96c04e3cf0b797290dbcc1403d36fd6a6fa26e87c865283ec4086621b.exe

description	pid	process	target process
PID 1264 set thread context of 4780	1264	4a90cac96c04e3cf0b797290dbcc1403d36fd6a6fa26e87c865283ec4086621b.exe	4a90cac96c04e3cf0b797290dbcc1403d36fd6a6fa26e87c865283ec4086621b.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
5024	4780	WerFault.exe	4a90cac96c04e3cf0b797290dbcc1403d36fd6a6fa26e87c865283ec4086621b.exe
2560	1264	WerFault.exe	4a90cac96c04e3cf0b797290dbcc1403d36fd6a6fa26e87c865283ec4086621b.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

4a90cac96c04e3cf0b797290dbcc1403d36fd6a6fa26e87c865283ec4086621b.exe

description	pid	process	target process
PID 1264 wrote to memory of 4780	1264	4a90cac96c04e3cf0b797290dbcc1403d36fd6a6fa26e87c865283ec4086621b.exe	4a90cac96c04e3cf0b797290dbcc1403d36fd6a6fa26e87c865283ec4086621b.exe
PID 1264 wrote to memory of 4780	1264	4a90cac96c04e3cf0b797290dbcc1403d36fd6a6fa26e87c865283ec4086621b.exe	4a90cac96c04e3cf0b797290dbcc1403d36fd6a6fa26e87c865283ec4086621b.exe
PID 1264 wrote to memory of 4780	1264	4a90cac96c04e3cf0b797290dbcc1403d36fd6a6fa26e87c865283ec4086621b.exe	4a90cac96c04e3cf0b797290dbcc1403d36fd6a6fa26e87c865283ec4086621b.exe
PID 1264 wrote to memory of 4780	1264	4a90cac96c04e3cf0b797290dbcc1403d36fd6a6fa26e87c865283ec4086621b.exe	4a90cac96c04e3cf0b797290dbcc1403d36fd6a6fa26e87c865283ec4086621b.exe
PID 1264 wrote to memory of 4780	1264	4a90cac96c04e3cf0b797290dbcc1403d36fd6a6fa26e87c865283ec4086621b.exe	4a90cac96c04e3cf0b797290dbcc1403d36fd6a6fa26e87c865283ec4086621b.exe

C:\Users\Admin\AppData\Local\Temp\4a90cac96c04e3cf0b797290dbcc1403d36fd6a6fa26e87c865283ec4086621b.exe
"C:\Users\Admin\AppData\Local\Temp\4a90cac96c04e3cf0b797290dbcc1403d36fd6a6fa26e87c865283ec4086621b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1264

C:\Users\Admin\AppData\Local\Temp\4a90cac96c04e3cf0b797290dbcc1403d36fd6a6fa26e87c865283ec4086621b.exe
C:\Users\Admin\AppData\Local\Temp\4a90cac96c04e3cf0b797290dbcc1403d36fd6a6fa26e87c865283ec4086621b.exe
2⤵
PID:4780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 12
3⤵
- Program crash
PID:5024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 256
2⤵
- Program crash
PID:2560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4780 -ip 4780
1⤵
PID:4956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1264 -ip 1264
1⤵
PID:3436

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1264-132-0x0000000001000000-0x0000000001015000-memory.dmp

Filesize
84KB

Download
memory/1264-133-0x0000000001000000-0x0000000001015000-memory.dmp

Filesize
84KB

Download
memory/4780-130-0x0000000000000000-mapping.dmp

Download
memory/4780-131-0x0000000029A00000-0x0000000029A1E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads