metasploit | 14dfd63b88d40fc28aee282a6f12db1acc8ddb2a411ef42c056ca322ea5009d4

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 03:43

Target

tmp_1694527752.exe
Size

66KB
MD5

0ae657ac3ec805132a579971e182f2ca
SHA1

cc2659b86636d18504989d5f56ff35a8047ef41f
SHA256

14dfd63b88d40fc28aee282a6f12db1acc8ddb2a411ef42c056ca322ea5009d4
SHA512

3245fa3374bfdcee7ff668d7629837f5f3634ff2a11f16944efacb1341a3b0275842cfc95d7069ec365c3ad7b12b973812fbdb4eb2e75f5bb5ffd513830141a3
SSDEEP

1536:mDXPXdb6Ep1TxLcupqdg7ERfjM16oF/070:mDftb6c1TxLcuovg16ZI

Score

10^/10

Family

metasploit

Version

windows/reverse_tcp

116.196.98.0:2000

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

tmp_1694527752.exe

description	pid	process	target process
PID 2068 wrote to memory of 1948	2068	tmp_1694527752.exe	explorer.exe
PID 2068 wrote to memory of 1948	2068	tmp_1694527752.exe	explorer.exe
PID 2068 wrote to memory of 1948	2068	tmp_1694527752.exe	explorer.exe
PID 2068 wrote to memory of 1948	2068	tmp_1694527752.exe	explorer.exe
PID 2068 wrote to memory of 1948	2068	tmp_1694527752.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\tmp_1694527752.exe
"C:\Users\Admin\AppData\Local\Temp\tmp_1694527752.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2068

memory/1948-1-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1948-2-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2068-0-0x0000000001D50000-0x0000000001D90000-memory.dmp

Filesize
256KB

Download
memory/2068-3-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2068-5-0x0000000001D50000-0x0000000001D90000-memory.dmp

Filesize
256KB

Download