metasploit | 86359607f63c09a72a8991dab0b6a5879fc59513c99ed420341400ce13680d84 | Triage

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
19-07-2022 06:13

Sharing

Report Analysis Logs

General

Target

86359607f63c09a72a8991dab0b6a5879fc59513c99ed420341400ce13680d84.dll
Size

320KB
MD5

748d9004eb2010b2aceddaaa6e387e16
SHA1

24a03451f8d06a78c76b7559c44d786355520764
SHA256

86359607f63c09a72a8991dab0b6a5879fc59513c99ed420341400ce13680d84
SHA512

f34ec3bb8320f6c591a2fb723fa3d290767d49638085d7368ef47a2ae7f1d7bbfe518e67d4e218971e4bfec77f43af2e56a418df473090cb1270ec48617e98a6

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1840 rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1820 wrote to memory of 1840	1820	rundll32.exe	rundll32.exe
PID 1820 wrote to memory of 1840	1820	rundll32.exe	rundll32.exe
PID 1820 wrote to memory of 1840	1820	rundll32.exe	rundll32.exe
PID 1820 wrote to memory of 1840	1820	rundll32.exe	rundll32.exe
PID 1820 wrote to memory of 1840	1820	rundll32.exe	rundll32.exe
PID 1820 wrote to memory of 1840	1820	rundll32.exe	rundll32.exe
PID 1820 wrote to memory of 1840	1820	rundll32.exe	rundll32.exe
PID 1840 wrote to memory of 1044	1840	rundll32.exe	ieUnatt.exe
PID 1840 wrote to memory of 1044	1840	rundll32.exe	ieUnatt.exe
PID 1840 wrote to memory of 1044	1840	rundll32.exe	ieUnatt.exe
PID 1840 wrote to memory of 1044	1840	rundll32.exe	ieUnatt.exe
PID 1840 wrote to memory of 1044	1840	rundll32.exe	ieUnatt.exe
PID 1840 wrote to memory of 1044	1840	rundll32.exe	ieUnatt.exe
PID 1840 wrote to memory of 1044	1840	rundll32.exe	ieUnatt.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\86359607f63c09a72a8991dab0b6a5879fc59513c99ed420341400ce13680d84.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\86359607f63c09a72a8991dab0b6a5879fc59513c99ed420341400ce13680d84.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1840

C:\Windows\SysWOW64\ieUnatt.exe
C:\Windows\System32\ieUnatt.exe
3⤵
PID:1044

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1840-54-0x0000000000000000-mapping.dmp

Download
memory/1840-55-0x0000000076C01000-0x0000000076C03000-memory.dmp

Filesize
8KB

Download
memory/1840-56-0x0000000000180000-0x000000000018D000-memory.dmp

Filesize
52KB

Download