metasploit | f037d766d858fc7ca62f87fed5255409fff5ce21f19121b39873d564ccda5280

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2023, 15:19

Target

f037d766d858fc7ca62f87fed5255409fff5ce21f19121b39873d564ccda5280.dll
Size

79KB
MD5

55f34292522c6f8b39420ec8a00f02e9
SHA1

b3d575692de416222549022af9088f0bd30665db
SHA256

f037d766d858fc7ca62f87fed5255409fff5ce21f19121b39873d564ccda5280
SHA512

ca9cba7ff0768113087b175abeaaecdca74eb8a6a1153af15b7e0e9f82ec84df8b8d272ff65855f81bccf7e602057fa964058c1191860df43aeb9054bf11b635
SSDEEP

768:0DunYPhPv+VIApYISxhyyyLqnSuOdtwIyTCbME9xC3/VtVlT5:S4gmpYJyVLqnwtwIyTCbFxq/9

Score

10^/10

Family

metasploit

Version

windows/download_exec

http://121.36.250.124:8088/DEqb

Attributes

headers User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Trident/6.0)

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	1048	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 1048	4192	rundll32.exe	81
PID 4192 wrote to memory of 1048	4192	rundll32.exe	81
PID 4192 wrote to memory of 1048	4192	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f037d766d858fc7ca62f87fed5255409fff5ce21f19121b39873d564ccda5280.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f037d766d858fc7ca62f87fed5255409fff5ce21f19121b39873d564ccda5280.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:1048

memory/1048-133-0x0000000000AC0000-0x0000000000AC2000-memory.dmp

Filesize
8KB

Download
memory/1048-134-0x0000000062540000-0x000000006255C000-memory.dmp

Filesize
112KB

Download