metasploit | e24e04c54347cc49a8e2e759636aed26cff3a94fffbc9c6155fe55ecf2539d2f

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 09:20

Target

e24e04c54347cc49a8e2e759636aed26cff3a94fffbc9c6155fe55ecf2539d2f.exe
Size

1.9MB
MD5

cd32fc4f8487d3187d2060919120a6ee
SHA1

e980f3044bb572bf4fe5bd37f2a1b437f4d8a4ea
SHA256

e24e04c54347cc49a8e2e759636aed26cff3a94fffbc9c6155fe55ecf2539d2f
SHA512

6ff87b87b432bc80585a14926aea2f3d65f3ec6a1caf35e357e200599b14320f331f6a4a46418a78fb3be3e7fe2ab0bcdb17aa713d9a671d8dea91f9df78a098
SSDEEP

49152:6o4o2O9f65YTz7jGnD3D121zsax1KWMXzGqIFI2tb+FI2t:6TMwrMIWMXZIG2tyG2t

Score

10^/10

Family

metasploit

Version

metasploit_stager

192.168.31.42:4444

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

e24e04c54347cc49a8e2e759636aed26cff3a94fffbc9c6155fe55ecf2539d2f.exe

pid process

2592 e24e04c54347cc49a8e2e759636aed26cff3a94fffbc9c6155fe55ecf2539d2f.exe

pid	process
2592	e24e04c54347cc49a8e2e759636aed26cff3a94fffbc9c6155fe55ecf2539d2f.exe

C:\Users\Admin\AppData\Local\Temp\e24e04c54347cc49a8e2e759636aed26cff3a94fffbc9c6155fe55ecf2539d2f.exe
"C:\Users\Admin\AppData\Local\Temp\e24e04c54347cc49a8e2e759636aed26cff3a94fffbc9c6155fe55ecf2539d2f.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2592

memory/2592-0-0x0000000140000000-0x00000001401FAEF0-memory.dmp

Filesize
2.0MB

Download