metasploit | 92aa56502b7643248c5dcae5d1391bf7aa60065a153f58c35b46fe679f7eb362

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 14:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
92aa56502b7643248c5dcae5d1391bf7aa60065a153f58c35b46fe679f7eb362.exe
Size 4.6MB
Sample240526-rn4jqaaa73
SHA256 92aa56502b7643248c5dcae5d1391bf7aa60065a153f58c35b46fe679f7eb362
MD5 8504b5cd851e7bc6e40689123d1b63dc
SHA1 b5429076b22ac0ba859dd838cc3474413b3b601e
SHA512 80b0f74bb108a8676af7f777a2026dce92652e1a541617a578aeb28855a969ae004c82b089fa6e502b6381fcda64e0448c0d407a2cedc22a834f067e07f511a1
SSDEEP 98304:/sYHQcsibw8SPLeTtSQo5Z8DERxrfExYzxc960OTbJd6ufJLF:kYwcXMHLKy6tx4c9WnJ5L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

192.168.188.128:5577

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Loads dropped DLL 4 IoCs

pid	Process
3152	92aa56502b7643248c5dcae5d1391bf7aa60065a153f58c35b46fe679f7eb362.exe
3152	92aa56502b7643248c5dcae5d1391bf7aa60065a153f58c35b46fe679f7eb362.exe
3152	92aa56502b7643248c5dcae5d1391bf7aa60065a153f58c35b46fe679f7eb362.exe
3152	92aa56502b7643248c5dcae5d1391bf7aa60065a153f58c35b46fe679f7eb362.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: 35	3152	92aa56502b7643248c5dcae5d1391bf7aa60065a153f58c35b46fe679f7eb362.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 3152	624	92aa56502b7643248c5dcae5d1391bf7aa60065a153f58c35b46fe679f7eb362.exe	84
PID 624 wrote to memory of 3152	624	92aa56502b7643248c5dcae5d1391bf7aa60065a153f58c35b46fe679f7eb362.exe	84
PID 624 wrote to memory of 3152	624	92aa56502b7643248c5dcae5d1391bf7aa60065a153f58c35b46fe679f7eb362.exe	84

C:\Users\Admin\AppData\Local\Temp\92aa56502b7643248c5dcae5d1391bf7aa60065a153f58c35b46fe679f7eb362.exe
"C:\Users\Admin\AppData\Local\Temp\92aa56502b7643248c5dcae5d1391bf7aa60065a153f58c35b46fe679f7eb362.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:624
- C:\Users\Admin\AppData\Local\Temp\92aa56502b7643248c5dcae5d1391bf7aa60065a153f58c35b46fe679f7eb362.exe
  "C:\Users\Admin\AppData\Local\Temp\92aa56502b7643248c5dcae5d1391bf7aa60065a153f58c35b46fe679f7eb362.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:3152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

1.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\_MEI6242\1.exe.manifest
Size 1KB
SHA256 b49026e09006b519c4168f37c6311a92738592d5ba6451975c183caaa150f0e5
MD5 0438cd033a562d3185f556f430fe722a
SHA1 aa2b55ac2476df339f8d3136f20a5709bde0f69c
SHA512 f80657ed9481c38505fe1358fabb6b54e9b29cac28bf3219e0124420e30bec28a5c3e50e883d8465f6d7437a433b0ce730f1b37e8890acaded9f5bda4a817b43
MD5 SHA1 SHA512

Submit Download

Crypto.Cipher._AES.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI6242\Crypto.Cipher._AES.pyd
Size 29KB
SHA256 c7e4194470a677304fad05c771654e6986c32bc29a04c3c4c52594172d83cb23
MD5 3c4ab2e06feb6e4ca1b7a1244055671a
SHA1 a4c3c44b45248b7cf53881e6d8efa8d557e100a9
SHA512 7531b4ecf3c2a37b33b790e403cf69c6c90c33b0236ad65996fad6e5fdd0e831935126ed96026f612d6fdd2847f2d7b01823f49fbdbd8c95b434fbdd9aaf557c
SSDEEP 768:UWdwmRjwkjXxnWBVU8tahoICS4AIKSrdQa:1RkkjXxnW7U8xICS4ADSp
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSVCR100.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI6242\MSVCR100.dll
Size 755KB
SHA256 60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
MD5 bf38660a9125935658cfa3e53fdc7d65
SHA1 0b51fb415ec89848f339f8989d323bea722bfd70
SHA512 25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1
SSDEEP 12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BV0eAI:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV4I
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI6242\_ctypes.pyd
Size 83KB
SHA256 97c3cdef6d28ad19c0dacff15dd66f874fe73c8767d88f3bc7c0bde794d857da
MD5 5d1bc1be2f02b4a2890e921af15190d2
SHA1 057c88438b40cd8e73554274171341244f107139
SHA512 9751f471312dd5a24f4a7f25b192ddcb64d28a332ff66f3aa2c3f7ef69127cf14c93043350397e9f884f1830f51d5e01214e82627158d37ef95ce4746a83bbd9
SSDEEP 1536:Oo5A1EQ38XUL9c+mCvqM8SQMkN/E+yJipQo4AFAr4kRhH:OhDo4wO32/JyUpnFGMAhH
MD5 SHA1 SHA512 SSDEEP

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI6242\base_library.zip
Size 717KB
SHA256 18a0fa1644ac09334dae491a5be7973b927a95ab7fcc8e8828ccbb249a5ed369
MD5 cdf57168a1995b187681efea85b33500
SHA1 1e852b89fbd1adf4abc5135dbf7fbba53d3f38ec
SHA512 9082951c3889d94e271f564893781f697ed2de5edfa9a033f7531a172d6349c14d23666f1b1857c09979d5518f19d7096bd7c3719d7e3302aa9eb92374c63e1e
SSDEEP 12288:Os74EsWO9VjyJqZQMU4qOGiPrcUZpbE5OqcCkEmj3s/ZY:Os74yiPrc29CHI
MD5 SHA1 SHA512 SSDEEP

Submit Download

python34.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI6242\python34.dll
Size 2.6MB
SHA256 0f14047ea66eae192a9750f7b0e329873e8b554de58ca332c9acbdc4d63e10e3
MD5 4ee1ea91b7263bed66ff01bc80649e90
SHA1 a93b548933b291c13bb2e7cbc0c17409d2f875a4
SHA512 ef52f934aa39b5d6c6f152a9b5a159957e68471d117bd002330ee18d9143987d79dd7bce9208ce0ffb0699acb05169a15ed75d2ce4128e52e31b7f60f3ee51a4
SSDEEP 49152:SLFTVWvNvZoHK61aJYuC2TboWADOjUfZpTeCIVlHP2nmMbUPEbV1b3ijpbh:SgJRHgOjfrjHumMb1hsjpl
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/624-27-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/3152-25-0x0000000000C70000-0x0000000000C71000-memory.dmp

Download

memory/3152-28-0x0000000000400000-0x0000000000430000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads