metasploit | e61039af40cb17c28aaf3d75e4332e5b070ebfd91b7c7891f8b38d4bbe4f39e8

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 14:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e61039af40cb17c28aaf3d75e4332e5b070ebfd91b7c7891f8b38d4bbe4f39e8.exe
Size

3.2MB
MD5

145f0ccb4a3ac4a798ed7352825dfed0
SHA1

3d6d72f2f1d86b82be7b8f4a840954db61508639
SHA256

e61039af40cb17c28aaf3d75e4332e5b070ebfd91b7c7891f8b38d4bbe4f39e8
SHA512

66abba6b019f21f8f3a7f8e8b26931909759fc5f442ffc5b66b332e8bfbdcaef744a2f8a1b68fa5954d5766e03d340cee1cbc7f1ffcd0a2cc25b877e280eb297
SSDEEP

98304:owOBfKtpt+7+KfLzHiN/iYttBMqjkqDDc:NN+CWzCN/ikuqjkS

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

192.168.5.132:4444

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

e61039af40cb17c28aaf3d75e4332e5b070ebfd91b7c7891f8b38d4bbe4f39e8.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	e61039af40cb17c28aaf3d75e4332e5b070ebfd91b7c7891f8b38d4bbe4f39e8.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

e61039af40cb17c28aaf3d75e4332e5b070ebfd91b7c7891f8b38d4bbe4f39e8.exe

pid process

2352 e61039af40cb17c28aaf3d75e4332e5b070ebfd91b7c7891f8b38d4bbe4f39e8.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

e61039af40cb17c28aaf3d75e4332e5b070ebfd91b7c7891f8b38d4bbe4f39e8.exe

pid	process
2352	e61039af40cb17c28aaf3d75e4332e5b070ebfd91b7c7891f8b38d4bbe4f39e8.exe
2352	e61039af40cb17c28aaf3d75e4332e5b070ebfd91b7c7891f8b38d4bbe4f39e8.exe

C:\Users\Admin\AppData\Local\Temp\e61039af40cb17c28aaf3d75e4332e5b070ebfd91b7c7891f8b38d4bbe4f39e8.exe
"C:\Users\Admin\AppData\Local\Temp\e61039af40cb17c28aaf3d75e4332e5b070ebfd91b7c7891f8b38d4bbe4f39e8.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2352

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2352-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2352-9-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download