metasploit | a26d2d6e2027312156914ea918e8ec5058f310852c3b45877d56c37c47acc3cf

Analysis

max time kernel
91s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2024 12:33

Target

a26d2d6e2027312156914ea918e8ec5058f310852c3b45877d56c37c47acc3cf.exe
Size

5.4MB
MD5

342c2f771ac258ff0a03e68c5164daff
SHA1

6f05adbacb0881ff4487740ea2de06a072f177aa
SHA256

a26d2d6e2027312156914ea918e8ec5058f310852c3b45877d56c37c47acc3cf
SHA512

eefd6bdf935005808266c4836ac33d52d8c511b5e99b36a4362a01a4b4ae99025e7ba449c46f03c0535385ac8c9e51ea02b8d6e996dc33343e97688c4a1beea9
SSDEEP

98304:cCF+OIyoWoZ61i0hUNfHBiCV2HW/40hUNfHBiCV2HvNX/:f+OIynoRjNIK4jNYB

Score

10^/10

Family

metasploit

Version

encoder/shikata_ga_nai

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Loads dropped DLL 3 IoCs

Processes:

a26d2d6e2027312156914ea918e8ec5058f310852c3b45877d56c37c47acc3cf.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
3228	1668	WerFault.exe	a26d2d6e2027312156914ea918e8ec5058f310852c3b45877d56c37c47acc3cf.exe
432	1668	WerFault.exe	a26d2d6e2027312156914ea918e8ec5058f310852c3b45877d56c37c47acc3cf.exe

C:\Users\Admin\AppData\Local\Temp\a26d2d6e2027312156914ea918e8ec5058f310852c3b45877d56c37c47acc3cf.exe
"C:\Users\Admin\AppData\Local\Temp\a26d2d6e2027312156914ea918e8ec5058f310852c3b45877d56c37c47acc3cf.exe"
1⤵
- Loads dropped DLL
PID:1668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 552
2⤵
- Program crash
PID:3228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 1516
2⤵
- Program crash
PID:432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1668 -ip 1668
1⤵
PID:1644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1668 -ip 1668
1⤵
PID:3860

C:\Users\Admin\AppData\Local\Temp\Setup\ds.dll
Filesize
67KB

MD5
7d5d3e2fcfa5ff53f5ae075ed4327b18

SHA1
3905104d8f7ba88b3b34f4997f3948b3183953f6

SHA256
e1fb95609f2757ce74cb531a5cf59674e411ea0a262b758371d7236c191910c4

SHA512
e67683331bb32ea4b2c38405be7f516db6935f883a1e4ae02a1700f5f36462c31b593e07c6fe06d8c0cb1c20c9f40a507c9eae245667c89f989e32765a89f589

Download Submit
memory/1668-0-0x0000000000400000-0x000000000097B094-memory.dmp

Filesize
5.5MB

Download
memory/1668-13-0x0000000005AD0000-0x0000000005AE0000-memory.dmp

Filesize
64KB

Download
memory/1668-14-0x0000000072A0E000-0x0000000072A0F000-memory.dmp

Filesize
4KB

Download
memory/1668-18-0x0000000005A40000-0x0000000005A54000-memory.dmp

Filesize
80KB

Download
memory/1668-19-0x0000000000400000-0x000000000097B094-memory.dmp

Filesize
5.5MB

Download