metasploit | 803eb608ac54661ccf23259c6a8d07fdc26bd83788a661dbd0cf1a08022d4a0f

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
27-03-2023 09:37

Target

tekdefense.dll
Size

14KB
MD5

1f3195eff807eceda24c74ea4c483f8c
SHA1

875b5d9b81e27ed8e5dc6fc8610813f68c5f59a9
SHA256

9420c9b7b0e45c2e5440c20cca570e991cbf151babf2537bf3dc08cf6d12c321
SHA512

15125f2c6d89af222fc092b20bf8a560d1913bf45ad54cbb6a94382fa8416054ba1b65261d0ba8e4ff3fbf825a41d7f27a9556dad3ea8e13f1ed7c4587a5c887
SSDEEP

48:6D640H+VzPiZerMpZytjWeyLhnhIAsYBlnfpJo+b23mRhHeq0JEI0oqtIzNi:WmHGzq6tjW33XlfprbSmRhsJNcy

Score

10^/10

Family

metasploit

Version

windows/download_exec

http://zwned.tekdefense.com:80/JpHZ

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1420 set thread context of 1360	1420	rundll32.exe	28

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 1420	1552	rundll32.exe	27
PID 1552 wrote to memory of 1420	1552	rundll32.exe	27
PID 1552 wrote to memory of 1420	1552	rundll32.exe	27
PID 1552 wrote to memory of 1420	1552	rundll32.exe	27
PID 1552 wrote to memory of 1420	1552	rundll32.exe	27
PID 1552 wrote to memory of 1420	1552	rundll32.exe	27
PID 1552 wrote to memory of 1420	1552	rundll32.exe	27
PID 1420 wrote to memory of 1360	1420	rundll32.exe	28
PID 1420 wrote to memory of 1360	1420	rundll32.exe	28
PID 1420 wrote to memory of 1360	1420	rundll32.exe	28
PID 1420 wrote to memory of 1360	1420	rundll32.exe	28
PID 1420 wrote to memory of 1360	1420	rundll32.exe	28
PID 1420 wrote to memory of 1360	1420	rundll32.exe	28
PID 1420 wrote to memory of 1360	1420	rundll32.exe	28
PID 1420 wrote to memory of 1360	1420	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\tekdefense.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\tekdefense.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe
    3⤵
    PID:1360

memory/1360-54-0x0000000000090000-0x0000000000092000-memory.dmp

Filesize
8KB

Download
memory/1360-55-0x0000000000090000-0x0000000000092000-memory.dmp

Filesize
8KB

Download