Overview

overview

10

Static

static

3

e4656ea477...ff.exe

windows7-x64

10

e4656ea477...ff.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    04-05-2024 10:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e4656ea47705d71236e3cd964b19f1381b17938bedf85f0819409b08e8fb3aff.exe

  • Size

    1.4MB

  • MD5

    32cf107558a09bec7223bc7a7f4f0681

  • SHA1

    018e19d403ef996629110b7c029f9b239fe69d3a

  • SHA256

    e4656ea47705d71236e3cd964b19f1381b17938bedf85f0819409b08e8fb3aff

  • SHA512

    65374409a63bee5d50ec80690ea24f30cfb68b2d5d3827f78a2dcf97ceb071baff2cdb06cdffea41e3fb9f131d06083388371066f7051e2d3b253b41d5045301

  • SSDEEP

    24576:hLDHj3zRtCcu4D39s70f9iXuYH7oVRnY01aJFYX6VTbfCVGs:kl7+JxY01asX6VTbfl

Score
10/10
metasploitbackdoortrojan

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://121.40.254.24:8997/N8sc

Attributes
  • headers User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20130330 Firefox/21.0

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

Processes

  • C:\Users\Admin\AppData\Local\Temp\e4656ea47705d71236e3cd964b19f1381b17938bedf85f0819409b08e8fb3aff.exe
    "C:\Users\Admin\AppData\Local\Temp\e4656ea47705d71236e3cd964b19f1381b17938bedf85f0819409b08e8fb3aff.exe"
    1⤵
      PID:2356

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2356-0-0x0000000001F40000-0x0000000001F41000-memory.dmp
      Filesize

      4KB

      Download