metasploit | b1e8df3a649abba833ba87d7b8b683d4eedc42e5ce0f109b9154d40c5e939a85

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2023, 04:11

Target

b1e8df3a649abba833ba87d7b8b683d4eedc42e5ce0f109b9154d40c5e939a85.exe
Size

1.3MB
MD5

715d4ac7a389acc5db7d001ca750754d
SHA1

a36bc516cb7de4a8cc29d444af99021e4635fad3
SHA256

b1e8df3a649abba833ba87d7b8b683d4eedc42e5ce0f109b9154d40c5e939a85
SHA512

ea128b7aa150772f359e4a7dba44e008a85c1a12d561cfbcbb0cbcf0fe49fbe75ed88ce74d53ed1b9a82e616cd385b9c0a3854af11b3190ea98b0effd392d3d2
SSDEEP

12288:+eumY51d94ROk0/5tHZusQMcnpea/OKz2I1zXEgOMjBwQfxfirYyltS7PORxilh:Tc5H94snxtHZPQhZrEgRjtfy7DxiD1C

Score

10^/10

Family

metasploit

Version

metasploit_stager

43.138.26.158:10000

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{3A792CF0-6560-4AAB-B39B-ACC7A5D18973}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{407EEF6E-139F-4C47-8E0E-800940668CE2}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{BCAE4B20-0CCD-4799-802B-F014CBADC9DB}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{23FBE03B-770D-4179-8F02-1D578AFF5667}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{3F509139-94D6-427A-AF53-2421C1D2D77B}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{F2ACC712-8C37-48F2-8203-A8A3A071FF80}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{668BD495-87BD-44C2-948A-59F14EF2B6E1}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{5FF37384-30CD-4DF9-8C50-1C2BEDAE3386}.catalogItem	svchost.exe

C:\Users\Admin\AppData\Local\Temp\b1e8df3a649abba833ba87d7b8b683d4eedc42e5ce0f109b9154d40c5e939a85.exe
"C:\Users\Admin\AppData\Local\Temp\b1e8df3a649abba833ba87d7b8b683d4eedc42e5ce0f109b9154d40c5e939a85.exe"
1⤵
PID:4644

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
PID:1148

memory/4644-133-0x00000220FEDE0000-0x00000220FEDE1000-memory.dmp

Filesize
4KB

Download