metasploit | 7e62df2b565cc1c15eb4cad946effb8e981211383a459ddc7147d46a68c9f05a

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
31-07-2022 20:27

Target

7e62df2b565cc1c15eb4cad946effb8e981211383a459ddc7147d46a68c9f05a.exe
Size

63KB
MD5

5e60a735afb32c3b19b186170964ffb9
SHA1

85e5c44b173b26791e0d5304f2028111250cb092
SHA256

7e62df2b565cc1c15eb4cad946effb8e981211383a459ddc7147d46a68c9f05a
SHA512

10b3a05a5fdcb93b80aaf832f315661576e7698b354997dc8f050295c1de8b021cef986cc3bdae8cf65125bca3db9882daeba211e6ff52d10fecfbd17cf92a67

Score

10^/10

Family

metasploit

Version

encoder/call4_dword_xor

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1976-55-0x0000000000400000-0x0000000000492000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

Processes:

7e62df2b565cc1c15eb4cad946effb8e981211383a459ddc7147d46a68c9f05a.exe

description	ioc	process
File created	C:\Windows\SysWOW64\csrsc.exe	7e62df2b565cc1c15eb4cad946effb8e981211383a459ddc7147d46a68c9f05a.exe
File opened for modification	C:\Windows\SysWOW64\csrsc.exe	7e62df2b565cc1c15eb4cad946effb8e981211383a459ddc7147d46a68c9f05a.exe

C:\Users\Admin\AppData\Local\Temp\7e62df2b565cc1c15eb4cad946effb8e981211383a459ddc7147d46a68c9f05a.exe
"C:\Users\Admin\AppData\Local\Temp\7e62df2b565cc1c15eb4cad946effb8e981211383a459ddc7147d46a68c9f05a.exe"
1⤵
- Drops file in System32 directory
PID:1976

memory/1976-54-0x0000000075301000-0x0000000075303000-memory.dmp

Filesize
8KB

Download
memory/1976-55-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download