metasploit | eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 07:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe
Size

287KB
MD5

92f390f3cb3415d5a8a0288a78b28f27
SHA1

24112f35a3eb494dd9f3aa0f5f655e64a54c440d
SHA256

eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f
SHA512

4d97c7b06c7119b37a59513d1049b09ddfc00f8abeec14c5f741e4f50aca92294467fdaafc587e106a6564efe2325858a992e33aa8e137955ba52a8498ff9368
SSDEEP

6144:z5rnNHxNOCGBcJ/f4ywZfunnMARf4PZudC4z29ysAlgLdt42:dhHxNPmcJ/f4ynnMAtiKmyNk

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

http://45.227.253.109:3216/ZhKO

Attributes

headers User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; LBBROWSER)

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of SetThreadContext 1 IoCs

Processes:

eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe

description	pid	process	target process
PID 2812 set thread context of 2904	2812	eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe	eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe

description	pid	process	target process
PID 2812 wrote to memory of 2904	2812	eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe	eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe
PID 2812 wrote to memory of 2904	2812	eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe	eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe
PID 2812 wrote to memory of 2904	2812	eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe	eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe
PID 2812 wrote to memory of 2904	2812	eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe	eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe
PID 2812 wrote to memory of 2904	2812	eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe	eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe
PID 2812 wrote to memory of 2904	2812	eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe	eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe
PID 2812 wrote to memory of 2904	2812	eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe	eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe
PID 2812 wrote to memory of 2904	2812	eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe	eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe
PID 2812 wrote to memory of 2904	2812	eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe	eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe
PID 2812 wrote to memory of 2904	2812	eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe	eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe
PID 2812 wrote to memory of 2904	2812	eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe	eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe
PID 2812 wrote to memory of 2904	2812	eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe	eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe

C:\Users\Admin\AppData\Local\Temp\eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe
"C:\Users\Admin\AppData\Local\Temp\eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2812

C:\Users\Admin\AppData\Local\Temp\eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe
"C:\Users\Admin\AppData\Local\Temp\eef92884c9d53cb6c44e370704c466ace9deea5ca30ff3f87d57826b17e2559f.exe"
2⤵
PID:2904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2812-1-0x0000000000860000-0x0000000000960000-memory.dmp

Filesize
1024KB

Download
memory/2812-2-0x0000000000850000-0x0000000000855000-memory.dmp

Filesize
20KB

Download
memory/2904-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2904-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2904-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2904-7-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2904-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download