metasploit | 0b00aa0230c0f2da572bb187ad046581d1e966c5c7cef88269be8a0d5dfebbc1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 17:36

Target

c131bbe674aa7bb20a74a8cef79b6d2f.exe
Size

104KB
MD5

c131bbe674aa7bb20a74a8cef79b6d2f
SHA1

7c0036a0000dc0dd5762193641f2c30493a31efd
SHA256

0b00aa0230c0f2da572bb187ad046581d1e966c5c7cef88269be8a0d5dfebbc1
SHA512

d62e819c30ba781a3abef0e80e92dfd346d2efe57501dabd3462fbc5e7ea516c76bd02d66123d4a99a0389941247043d7dcae9a6878720617cd3a017ff597d48
SSDEEP

1536:YSUgtGeEzWK27B67IYSEw6XUmxJhbwso8BAnB1KMPrABfuAYFVvyWO:YFdzUMkYMqJhbwWSnQYj8

Score

10^/10

Family

metasploit

Version

encoder/call4_dword_xor

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3424-0-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral2/memory/3424-5-0x0000000000400000-0x000000000042D000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3424 set thread context of 1372	3424	c131bbe674aa7bb20a74a8cef79b6d2f.exe	93

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3424	c131bbe674aa7bb20a74a8cef79b6d2f.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 1372	3424	c131bbe674aa7bb20a74a8cef79b6d2f.exe	93
PID 3424 wrote to memory of 1372	3424	c131bbe674aa7bb20a74a8cef79b6d2f.exe	93
PID 3424 wrote to memory of 1372	3424	c131bbe674aa7bb20a74a8cef79b6d2f.exe	93
PID 3424 wrote to memory of 1372	3424	c131bbe674aa7bb20a74a8cef79b6d2f.exe	93
PID 3424 wrote to memory of 1372	3424	c131bbe674aa7bb20a74a8cef79b6d2f.exe	93
PID 3424 wrote to memory of 1372	3424	c131bbe674aa7bb20a74a8cef79b6d2f.exe	93
PID 3424 wrote to memory of 1372	3424	c131bbe674aa7bb20a74a8cef79b6d2f.exe	93
PID 3424 wrote to memory of 1372	3424	c131bbe674aa7bb20a74a8cef79b6d2f.exe	93
PID 3424 wrote to memory of 1372	3424	c131bbe674aa7bb20a74a8cef79b6d2f.exe	93

C:\Users\Admin\AppData\Local\Temp\c131bbe674aa7bb20a74a8cef79b6d2f.exe
"C:\Users\Admin\AppData\Local\Temp\c131bbe674aa7bb20a74a8cef79b6d2f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Users\Admin\AppData\Local\Temp\c131bbe674aa7bb20a74a8cef79b6d2f.exe
  C:\Users\Admin\AppData\Local\Temp\c131bbe674aa7bb20a74a8cef79b6d2f.exe
  2⤵
  PID:1372

memory/1372-3-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1372-4-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3424-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/3424-5-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download