metasploit | f037d766d858fc7ca62f87fed5255409fff5ce21f19121b39873d564ccda5280

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
22-08-2023 15:19

Target

f037d766d858fc7ca62f87fed5255409fff5ce21f19121b39873d564ccda5280.dll
Size

79KB
MD5

55f34292522c6f8b39420ec8a00f02e9
SHA1

b3d575692de416222549022af9088f0bd30665db
SHA256

f037d766d858fc7ca62f87fed5255409fff5ce21f19121b39873d564ccda5280
SHA512

ca9cba7ff0768113087b175abeaaecdca74eb8a6a1153af15b7e0e9f82ec84df8b8d272ff65855f81bccf7e602057fa964058c1191860df43aeb9054bf11b635
SSDEEP

768:0DunYPhPv+VIApYISxhyyyLqnSuOdtwIyTCbME9xC3/VtVlT5:S4gmpYJyVLqnwtwIyTCbFxq/9

Score

10^/10

Family

metasploit

Version

windows/download_exec

http://121.36.250.124:8088/DEqb

Attributes

headers User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Trident/6.0)

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	632	rundll32.exe
5	632	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 632	1780	rundll32.exe	2
PID 1780 wrote to memory of 632	1780	rundll32.exe	2
PID 1780 wrote to memory of 632	1780	rundll32.exe	2
PID 1780 wrote to memory of 632	1780	rundll32.exe	2
PID 1780 wrote to memory of 632	1780	rundll32.exe	2
PID 1780 wrote to memory of 632	1780	rundll32.exe	2
PID 1780 wrote to memory of 632	1780	rundll32.exe	2

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f037d766d858fc7ca62f87fed5255409fff5ce21f19121b39873d564ccda5280.dll,#1
1⤵
- Blocklisted process makes network request
PID:632

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f037d766d858fc7ca62f87fed5255409fff5ce21f19121b39873d564ccda5280.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1780

memory/632-54-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/632-55-0x0000000062540000-0x000000006255C000-memory.dmp

Filesize
112KB

Download
memory/632-56-0x0000000062540000-0x000000006255C000-memory.dmp

Filesize
112KB

Download