metasploit | c6e2d06547835741970c77461a1007479a736685a4a122d0bd923b0147a8db7e

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2022 08:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c6e2d06547835741970c77461a1007479a736685a4a122d0bd923b0147a8db7e.exe
Size

232KB
MD5

5413049e5257bad82e58ab3795e4b9eb
SHA1

203346007429561717c99958d26c103d65b73cbe
SHA256

c6e2d06547835741970c77461a1007479a736685a4a122d0bd923b0147a8db7e
SHA512

58d7fd1e9830059d126d527134190b81426507367831af30550240c6fd91dea6da9ef15306c7e077510109845e1ce46949174ce5b122ba8282d47e3d671850ef
SSDEEP

3072:MJx4QevkIvEtiH0pvQyG3hOr5PFn0wccccccccwC8ziwKETYko9SYIqUB/f:MJxMUPFn0wccccccccV8ziwKMFZ5Bxf

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of SetThreadContext 1 IoCs

Processes:

c6e2d06547835741970c77461a1007479a736685a4a122d0bd923b0147a8db7e.exe

description	pid	process	target process
PID 704 set thread context of 2056	704	c6e2d06547835741970c77461a1007479a736685a4a122d0bd923b0147a8db7e.exe	c6e2d06547835741970c77461a1007479a736685a4a122d0bd923b0147a8db7e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

c6e2d06547835741970c77461a1007479a736685a4a122d0bd923b0147a8db7e.exe

pid process

704 c6e2d06547835741970c77461a1007479a736685a4a122d0bd923b0147a8db7e.exe

pid	process
704	c6e2d06547835741970c77461a1007479a736685a4a122d0bd923b0147a8db7e.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

c6e2d06547835741970c77461a1007479a736685a4a122d0bd923b0147a8db7e.exe

description	pid	process	target process
PID 704 wrote to memory of 2056	704	c6e2d06547835741970c77461a1007479a736685a4a122d0bd923b0147a8db7e.exe	c6e2d06547835741970c77461a1007479a736685a4a122d0bd923b0147a8db7e.exe
PID 704 wrote to memory of 2056	704	c6e2d06547835741970c77461a1007479a736685a4a122d0bd923b0147a8db7e.exe	c6e2d06547835741970c77461a1007479a736685a4a122d0bd923b0147a8db7e.exe
PID 704 wrote to memory of 2056	704	c6e2d06547835741970c77461a1007479a736685a4a122d0bd923b0147a8db7e.exe	c6e2d06547835741970c77461a1007479a736685a4a122d0bd923b0147a8db7e.exe
PID 704 wrote to memory of 2056	704	c6e2d06547835741970c77461a1007479a736685a4a122d0bd923b0147a8db7e.exe	c6e2d06547835741970c77461a1007479a736685a4a122d0bd923b0147a8db7e.exe
PID 704 wrote to memory of 2056	704	c6e2d06547835741970c77461a1007479a736685a4a122d0bd923b0147a8db7e.exe	c6e2d06547835741970c77461a1007479a736685a4a122d0bd923b0147a8db7e.exe
PID 704 wrote to memory of 2056	704	c6e2d06547835741970c77461a1007479a736685a4a122d0bd923b0147a8db7e.exe	c6e2d06547835741970c77461a1007479a736685a4a122d0bd923b0147a8db7e.exe
PID 704 wrote to memory of 2056	704	c6e2d06547835741970c77461a1007479a736685a4a122d0bd923b0147a8db7e.exe	c6e2d06547835741970c77461a1007479a736685a4a122d0bd923b0147a8db7e.exe
PID 704 wrote to memory of 2056	704	c6e2d06547835741970c77461a1007479a736685a4a122d0bd923b0147a8db7e.exe	c6e2d06547835741970c77461a1007479a736685a4a122d0bd923b0147a8db7e.exe
PID 704 wrote to memory of 2056	704	c6e2d06547835741970c77461a1007479a736685a4a122d0bd923b0147a8db7e.exe	c6e2d06547835741970c77461a1007479a736685a4a122d0bd923b0147a8db7e.exe

C:\Users\Admin\AppData\Local\Temp\c6e2d06547835741970c77461a1007479a736685a4a122d0bd923b0147a8db7e.exe
"C:\Users\Admin\AppData\Local\Temp\c6e2d06547835741970c77461a1007479a736685a4a122d0bd923b0147a8db7e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:704

C:\Users\Admin\AppData\Local\Temp\c6e2d06547835741970c77461a1007479a736685a4a122d0bd923b0147a8db7e.exe
C:\Users\Admin\AppData\Local\Temp\c6e2d06547835741970c77461a1007479a736685a4a122d0bd923b0147a8db7e.exe
2⤵
PID:2056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2056-134-0x0000000000000000-mapping.dmp

Download
memory/2056-135-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2056-136-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download