metasploit | 878d380ba6de1513670bad39b77606f5b5b05136f29ba8f40838272ffb2c8fdd

Analysis

max time kernel
141s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15/01/2024, 13:04

Target
5d296a4d60654830cbdb55473b1b108a.exe
Size 3.1MB
Sample240115-qa7tjshcd4
SHA256 878d380ba6de1513670bad39b77606f5b5b05136f29ba8f40838272ffb2c8fdd
MD5 5d296a4d60654830cbdb55473b1b108a
SHA1 0e4a5453c5d274b49d8039c31ad52f1f2216f138
SHA512 c9e881214461c4fbf1c442a37a125e65b47deaf78f8cded0f467ecb23518961aaa567e6000d734730ca46d49de141ede25bcab73d03f4f7457fdea74cbc5b458
SSDEEP 49152:3ZiLmDjg0HEUKlTuK6igRROMCTI93qkw6SPjVqr1oO7jFj8Jlne+htT:wSDjTHEUKlTuKZgjsT63+60JqZZn58J
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Version

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 1512	4456	5d296a4d60654830cbdb55473b1b108a.exe	89
PID 4456 wrote to memory of 1512	4456	5d296a4d60654830cbdb55473b1b108a.exe	89

C:\Users\Admin\AppData\Local\Temp\5d296a4d60654830cbdb55473b1b108a.exe
"C:\Users\Admin\AppData\Local\Temp\5d296a4d60654830cbdb55473b1b108a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\5d296a4d60654830cbdb55473b1b108a.exe"
  2⤵
  PID:1512

memory/4456-0-0x0000000000970000-0x0000000000971000-memory.dmp

Download

memory/4456-1-0x0000000000970000-0x0000000000971000-memory.dmp

Download

memory/4456-3-0x0000000000400000-0x000000000071B000-memory.dmp

Download