metasploit | d04e93aca6fe28900f81d0f2462850400e045290cd51e5f19ddf884e02b58471

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 20:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b592dd98c6619bdccfd2a2ceb8f5e4b2.exe
Size

253KB
MD5

b592dd98c6619bdccfd2a2ceb8f5e4b2
SHA1

377ffe866538c44a43d688ca4bbd0c12ca74801e
SHA256

d04e93aca6fe28900f81d0f2462850400e045290cd51e5f19ddf884e02b58471
SHA512

e30f54f673c4d1842d4f2ceb13d8d8366170d85d015dbd8c0df7284cb7a448204824d40af708dfd0545316430cf68e21b455b9f5822d9091b21b3ff6ee5e7963
SSDEEP

3072:pbsUtq7WH2ZRTUKGkpRu2yW0XXUAE7n1kn9ot5KWDw+B92QPK7+vY/Z78eK2KL:pbsUESHsRQKfwren1bZ32X+vctK2

Score

10^/10

metasploit backdoor trojan upx

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1524-7-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/1524-11-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/1524-9-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/1524-14-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/1524-16-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/1524-17-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/1524-20-0x0000000000400000-0x0000000000455000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2236 set thread context of 1524	2236	b592dd98c6619bdccfd2a2ceb8f5e4b2.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2836	1524	WerFault.exe	28

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2236	b592dd98c6619bdccfd2a2ceb8f5e4b2.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 1524	2236	b592dd98c6619bdccfd2a2ceb8f5e4b2.exe	28
PID 2236 wrote to memory of 1524	2236	b592dd98c6619bdccfd2a2ceb8f5e4b2.exe	28
PID 2236 wrote to memory of 1524	2236	b592dd98c6619bdccfd2a2ceb8f5e4b2.exe	28
PID 2236 wrote to memory of 1524	2236	b592dd98c6619bdccfd2a2ceb8f5e4b2.exe	28
PID 2236 wrote to memory of 1524	2236	b592dd98c6619bdccfd2a2ceb8f5e4b2.exe	28
PID 2236 wrote to memory of 1524	2236	b592dd98c6619bdccfd2a2ceb8f5e4b2.exe	28
PID 2236 wrote to memory of 1524	2236	b592dd98c6619bdccfd2a2ceb8f5e4b2.exe	28
PID 2236 wrote to memory of 1524	2236	b592dd98c6619bdccfd2a2ceb8f5e4b2.exe	28
PID 1524 wrote to memory of 2836	1524	b592dd98c6619bdccfd2a2ceb8f5e4b2.exe	29
PID 1524 wrote to memory of 2836	1524	b592dd98c6619bdccfd2a2ceb8f5e4b2.exe	29
PID 1524 wrote to memory of 2836	1524	b592dd98c6619bdccfd2a2ceb8f5e4b2.exe	29
PID 1524 wrote to memory of 2836	1524	b592dd98c6619bdccfd2a2ceb8f5e4b2.exe	29

C:\Users\Admin\AppData\Local\Temp\b592dd98c6619bdccfd2a2ceb8f5e4b2.exe
"C:\Users\Admin\AppData\Local\Temp\b592dd98c6619bdccfd2a2ceb8f5e4b2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Users\Admin\AppData\Local\Temp\b592dd98c6619bdccfd2a2ceb8f5e4b2.exe
  "C:\Users\Admin\AppData\Local\Temp\b592dd98c6619bdccfd2a2ceb8f5e4b2.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 140
    3⤵
    - Program crash
    PID:2836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1524-4-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1524-1-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1524-7-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1524-11-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1524-9-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1524-14-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1524-16-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1524-17-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1524-20-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2236-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2236-2-0x0000000000230000-0x0000000000285000-memory.dmp

Filesize
340KB

Download
memory/2236-13-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download