metasploit | 81928dfd4a624418d8ca6a59cd27ee3c06e7e755756c9d4f1674b96c6e633f78

Analysis

max time kernel
140s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2024, 02:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7620b0578ea8d539ed86274eff069534.dll
Size 10KB
Sample240126-cqwvbscbe8
SHA256 81928dfd4a624418d8ca6a59cd27ee3c06e7e755756c9d4f1674b96c6e633f78
MD5 7620b0578ea8d539ed86274eff069534
SHA1 912dc0c2e9fce568f114607944719a45e1bcdd71
SHA512 2e6b99f45e75b8c9df95d32d2303433a9c0c39d4c5904110f3b81ec4dc8ddf5988e785aebe365e857678d1d9e6e6d9e4c5a672cccdfcf55211c1015dc3df6f35
SSDEEP 192:znmSFkLJuQffW8XZPIwBjOX8B9oVSQhhr7cHu:zntkfesI8j9rHQH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

http://34.92.45.90:50051/oHaD

Attributes

headers User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Blocklisted process makes network request 1 IoCs

flow	pid	Process
1	4608	rundll32.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2400 set thread context of 4608	2400	rundll32.exe	88

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 2400	3548	rundll32.exe	86
PID 3548 wrote to memory of 2400	3548	rundll32.exe	86
PID 3548 wrote to memory of 2400	3548	rundll32.exe	86
PID 2400 wrote to memory of 4608	2400	rundll32.exe	88
PID 2400 wrote to memory of 4608	2400	rundll32.exe	88
PID 2400 wrote to memory of 4608	2400	rundll32.exe	88
PID 2400 wrote to memory of 4608	2400	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7620b0578ea8d539ed86274eff069534.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7620b0578ea8d539ed86274eff069534.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe
    3⤵
    - Blocklisted process makes network request
    PID:4608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2400-0-0x0000000010000000-0x0000000010007000-memory.dmp

Download

memory/4608-1-0x0000000000840000-0x0000000000841000-memory.dmp