metasploit | a4b990527a7439738349dc225d6bbdb8aada977b9c52add94bc94ae897311b18

Analysis

max time kernel
144s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/02/2024, 10:43

Target
magic.exe
Size 34KB
Sample240205-msj9esgabl
SHA256 a4b990527a7439738349dc225d6bbdb8aada977b9c52add94bc94ae897311b18
MD5 3f69a87cb4bde9c863f39301eb1f29c8
SHA1 3c9de5d2605eb4419fe38c1728e97b6e7a9057ef
SHA512 d9fa11922158349c540adbd9a9e44062e42f7a5e9372ed89194554d536be186e239e254a2dac1fa40e8caace13c815e5f7a0d35fbd7007f251e5a8462408774d
SSDEEP 384:sckalfdKxiis5iHo40IKYb93V5XiVOcvbvx0fAmwD6:xlkxiihHo4fb93b4TvbOpq6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Version

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2020	magic.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1244	2020	magic.exe	16
PID 1244 wrote to memory of 2836	1244	Explorer.EXE	29
PID 1244 wrote to memory of 2836	1244	Explorer.EXE	29
PID 1244 wrote to memory of 2836	1244	Explorer.EXE	29

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Users\Admin\AppData\Local\Temp\magic.exe
  "C:\Users\Admin\AppData\Local\Temp\magic.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2020
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1244 -s 1044
  2⤵
  PID:2836

memory/1244-0-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Download

memory/1244-1-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Download

memory/1244-2-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Download