metasploit | bdaebb5a748736069f9df41f1cb6b9f0452e6968fa07c42ecea02599349b9958

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 07:26

Target

71a081183bbdf7902be62fe6d376dd49.exe
Size

256KB
MD5

71a081183bbdf7902be62fe6d376dd49
SHA1

56cdd67a57a781bef5d32d02274361ac0065a6d0
SHA256

bdaebb5a748736069f9df41f1cb6b9f0452e6968fa07c42ecea02599349b9958
SHA512

80d6176527e3985d237e4e4dccbb4cad96d04e08a073baa46ca744f282fff4ce9727bff153c47e65faec7622b3df9478b5214c0c89b7564d5091886ee6eb6d11
SSDEEP

3072:ccgs1P0Xb/Vi5UZQeZwGqQverUAIqCnUbGtwcmwg97ShOqP+iHTOI5iqTU61MiIs:Hgs50XbdMUZjlUzCnUsgVSkqPPdaiIs

Score

10^/10

Family

metasploit

Version

encoder/call4_dword_xor

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2972-3-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/2972-5-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/2972-7-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/2972-9-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/2972-12-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/2972-13-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/2972-14-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/2972-15-0x0000000000400000-0x0000000000455000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2888 set thread context of 2972	2888	71a081183bbdf7902be62fe6d376dd49.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2800	2972	WerFault.exe	28

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2972	2888	71a081183bbdf7902be62fe6d376dd49.exe	28
PID 2888 wrote to memory of 2972	2888	71a081183bbdf7902be62fe6d376dd49.exe	28
PID 2888 wrote to memory of 2972	2888	71a081183bbdf7902be62fe6d376dd49.exe	28
PID 2888 wrote to memory of 2972	2888	71a081183bbdf7902be62fe6d376dd49.exe	28
PID 2888 wrote to memory of 2972	2888	71a081183bbdf7902be62fe6d376dd49.exe	28
PID 2888 wrote to memory of 2972	2888	71a081183bbdf7902be62fe6d376dd49.exe	28
PID 2888 wrote to memory of 2972	2888	71a081183bbdf7902be62fe6d376dd49.exe	28
PID 2888 wrote to memory of 2972	2888	71a081183bbdf7902be62fe6d376dd49.exe	28
PID 2972 wrote to memory of 2800	2972	71a081183bbdf7902be62fe6d376dd49.exe	29
PID 2972 wrote to memory of 2800	2972	71a081183bbdf7902be62fe6d376dd49.exe	29
PID 2972 wrote to memory of 2800	2972	71a081183bbdf7902be62fe6d376dd49.exe	29
PID 2972 wrote to memory of 2800	2972	71a081183bbdf7902be62fe6d376dd49.exe	29

memory/2888-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2888-11-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2972-1-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2972-3-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2972-5-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2972-7-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2972-9-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2972-12-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2972-13-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2972-14-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2972-15-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download