Overview

overview

10

Static

static

3

Injection.vmp.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    46s
  • max time network
    49s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-05-2024 07:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Injection.vmp.exe

  • Size

    24.3MB

  • MD5

    030665b9bc6bb9368bcdc111893e6679

  • SHA1

    c6d2e1958a46e85b5d64f335f0fe6c44456f91f4

  • SHA256

    ac74dffe88b16fde19b002cfd864c9b77a19569277f1fa55dd2c98377eb70185

  • SHA512

    1aa94cc19771c2f4c3936c9321807534f2c514e86dca28b58e581ecbe597ac6322807d7af7d20ce5cce2c86b69b73093573a865984f1c4e28ff9fbe6176af925

  • SSDEEP

    393216:olwXPD3qYcjEyJpfuL4TVQ5akN1exrumG4pw5qBPlLmNO31TrLbhZc:+K2X20eakN5mfSkpmNO9nbhZc

Score
10/10
metasploitbackdoortrojan

Malware Config

Extracted

Family

metasploit

Version

metasploit_stager

C2

172.31.199.95:4444

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:3448
    • C:\Users\Admin\AppData\Local\Temp\Injection.vmp.exe
      "C:\Users\Admin\AppData\Local\Temp\Injection.vmp.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1408-0-0x00007FF66E698000-0x00007FF66F520000-memory.dmp
    Filesize

    14.5MB

    Download
  • memory/1408-1-0x00007FFEDC450000-0x00007FFEDC452000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1408-2-0x00007FFEDC460000-0x00007FFEDC462000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1408-3-0x00007FF66E670000-0x00007FF670D65000-memory.dmp
    Filesize

    39.0MB

    Download
  • memory/1408-6-0x00007FF66E670000-0x00007FF670D65000-memory.dmp
    Filesize

    39.0MB

    Download
  • memory/1408-7-0x00007FF66E670000-0x00007FF670D65000-memory.dmp
    Filesize

    39.0MB

    Download
  • memory/1408-9-0x00007FF66E698000-0x00007FF66F520000-memory.dmp
    Filesize

    14.5MB

    Download
  • memory/1408-10-0x00007FF66E670000-0x00007FF670D65000-memory.dmp
    Filesize

    39.0MB

    Download
  • memory/3448-8-0x00000000004E0000-0x00000000004E1000-memory.dmp
    Filesize

    4KB

    Download