metasploit | 5f3916cde8f3852fc370be7442e668f31a0d676f2ae912f88042481f972cc26a

Resubmissions

23-08-2023 05:35

11-06-2022 13:08

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23-08-2023 05:35

Target

e79d48bc650a2e1bd36d73f438826b8d.exe
Size

71KB
MD5

e79d48bc650a2e1bd36d73f438826b8d
SHA1

191e1644ca6b40fd8469d8013e4f931ac9877c18
SHA256

5f3916cde8f3852fc370be7442e668f31a0d676f2ae912f88042481f972cc26a
SHA512

7451442c8ff56ce0124efe429afbba480c71e56247f5cbebe83a0aa7107e9e3c3f68e891dfa928d1fc47be8c5fd715f59ebd252cf4d3d06f1eb471f6d422948d
SSDEEP

768:Vj0cZs7OEQXliffy5dNfxZgy21V/p+NTy2j7sisAz65as6oCEXasblUMkrm1FhuP:OcA5QVQfANwFG7j7LsjdlUM+bFpREy

Score

10^/10

Family

metasploit

Version

metasploit_stager

51.75.89.111:50438

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

e79d48bc650a2e1bd36d73f438826b8d.exe

description	pid	process	target process
PID 1996 wrote to memory of 2940	1996	e79d48bc650a2e1bd36d73f438826b8d.exe	svchost.exe
PID 1996 wrote to memory of 2940	1996	e79d48bc650a2e1bd36d73f438826b8d.exe	svchost.exe
PID 1996 wrote to memory of 2940	1996	e79d48bc650a2e1bd36d73f438826b8d.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\e79d48bc650a2e1bd36d73f438826b8d.exe
"C:\Users\Admin\AppData\Local\Temp\e79d48bc650a2e1bd36d73f438826b8d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1996

memory/1996-134-0x0000000002570000-0x0000000002580000-memory.dmp

Filesize
64KB

Download
memory/1996-135-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2940-133-0x000001F0BF6E0000-0x000001F0BF6E1000-memory.dmp

Filesize
4KB

Download