metasploit | 2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b

General

Target

2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
Size

704KB
MD5

3b4ab5a076808790010327773d071e25
SHA1

dce3d11427e6dc4dd1ae3c5c60ab3ad9e1800712
SHA256

2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b
SHA512

af672cd393726720bba4c63a418b2e0d44b612bc82ace1b738b19136831abcd6b3ce2fbd6e9333a231ce5cc5217c4ed6d4188373acbae5a5e871e400c2644c93
SSDEEP

12288:9R4RLJoKkJwRLab2xatbs1y63MZDbgi7xsK4Rwl:9R4RLJ5IcLM2Etbv4eDbldsKywl

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

152.136.174.227:111

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe

pid	process
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe

pid	process
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe

description	pid	process	target process
PID 4936 wrote to memory of 4676	4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe	svchost.exe
PID 4936 wrote to memory of 4676	4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe	svchost.exe
PID 4936 wrote to memory of 4676	4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe	svchost.exe
PID 4936 wrote to memory of 4676	4936	2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe
"C:\Users\Admin\AppData\Local\Temp\2c647c4742e27b3737eb51c6c82430d92ed6161dcd6703e87d7dd49109b7355b.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4936

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
PID:4676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4676-0-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads