metasploit | b2b7029d7e0cc09d143bddb474993490feea8bf5d85a8f035ab61847c9f42e1e | Triage

Analysis

max time kernel
133s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03-05-2024 22:02

Sharing

Report Analysis Logs

General

Target

backd.exe
Size

72KB
MD5

0bebee037f29663a3ea7ae975dcfe371
SHA1

fd774ded5f14049c01d54e53896f44eb3575f74e
SHA256

b2b7029d7e0cc09d143bddb474993490feea8bf5d85a8f035ab61847c9f42e1e
SHA512

2c8c8bf94d470b368e2c6a096b483efd13a944409291f3e6ff6bc626ce3001ee79560ea936936eaf0286e490f5b8a60e429254c2e69aefe3ab4b1440687957d6
SSDEEP

1536:IsKylULY4TrUPjen/CpIFH1xigwnfdHydsMb+KR0Nc8QsJq39:T3QTrU7e/PFbSS2e0Nc8QsC9

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

3.67.112.102:13911

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

388 5016 WerFault.exe backd.exe

C:\Users\Admin\AppData\Local\Temp\backd.exe
"C:\Users\Admin\AppData\Local\Temp\backd.exe"
1⤵
PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 300
2⤵
- Program crash
PID:388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5016 -ip 5016
1⤵
PID:3508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5016-0-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/5016-1-0x00000000008E0000-0x0000000000912000-memory.dmp

Filesize
200KB

Download