metasploit | b8589503320a67959d07b0742e4023bafb203435cd89afc76b4b56a1f8f6d2f5 | Triage

Analysis

max time kernel
146s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 12:43

Sharing

Report Analysis Logs

General

Target

bbd668fff3810c88a70f686b2ee7da99.exe
Size

76KB
MD5

bbd668fff3810c88a70f686b2ee7da99
SHA1

61e37acd8a82b56999304eadee10b6cbefcb483f
SHA256

b8589503320a67959d07b0742e4023bafb203435cd89afc76b4b56a1f8f6d2f5
SHA512

16bfe81d5bf775d694ac887c65ea556f2ec56d429e0556a0565e391ca3f20ceeb6efba21955e09bdea38cff8419dd846fb719cc648333b7b2e53ab9d1ebf5fab
SSDEEP

768:4NC7Rhm+7N7CjjwLWjACf275yrulwa6DOlfuX3J:4NC798j0LWjAWIgolGnJ

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings	calc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4080	OpenWith.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 3412	2008	bbd668fff3810c88a70f686b2ee7da99.exe	88
PID 2008 wrote to memory of 3412	2008	bbd668fff3810c88a70f686b2ee7da99.exe	88
PID 2008 wrote to memory of 3412	2008	bbd668fff3810c88a70f686b2ee7da99.exe	88

C:\Users\Admin\AppData\Local\Temp\bbd668fff3810c88a70f686b2ee7da99.exe
"C:\Users\Admin\AppData\Local\Temp\bbd668fff3810c88a70f686b2ee7da99.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  - Modifies registry class
  PID:3412

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2008-1-0x0000000001010000-0x0000000001110000-memory.dmp

Filesize
1024KB

Download
memory/2008-2-0x0000000001010000-0x0000000001110000-memory.dmp

Filesize
1024KB

Download