metasploit | 45466bb8c9df944bbe1ec77042ccb91a7ab7ec7005529f6635e90adc81885b51

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
02-06-2024 10:30

Target

45466bb8c9df944bbe1ec77042ccb91a7ab7ec7005529f6635e90adc81885b51.exe
Size

2.2MB
MD5

39062ba16d612942231798a0ff8db57a
SHA1

a89b784332c2bb17225fbd5f24de03e0374a53f0
SHA256

45466bb8c9df944bbe1ec77042ccb91a7ab7ec7005529f6635e90adc81885b51
SHA512

37573b5fd066b98f7ff636288360fa57e5db0601f4c789ba3ed7e5ae6af22013329477a196e61b805e4a40f190e8cf59f9bb20cc3b268cdcee30c1affff12aa5
SSDEEP

24576:U26SqYbeJa/R1GHjYDwZzlRogkvgaV6DPRaTGMQvYpH/airgJQdXwUZyT:TqbJuR1WjS2rXacRi8oai0Jmw0

Score

10^/10

Family

metasploit

Version

windows/download_exec

http://101.43.128.61:59871/api/v2/1/getinfo

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

45466bb8c9df944bbe1ec77042ccb91a7ab7ec7005529f6635e90adc81885b51.exe

description	pid	process	target process
PID 1844 wrote to memory of 1664	1844	45466bb8c9df944bbe1ec77042ccb91a7ab7ec7005529f6635e90adc81885b51.exe	notepad.exe
PID 1844 wrote to memory of 1664	1844	45466bb8c9df944bbe1ec77042ccb91a7ab7ec7005529f6635e90adc81885b51.exe	notepad.exe
PID 1844 wrote to memory of 1664	1844	45466bb8c9df944bbe1ec77042ccb91a7ab7ec7005529f6635e90adc81885b51.exe	notepad.exe
PID 1844 wrote to memory of 1664	1844	45466bb8c9df944bbe1ec77042ccb91a7ab7ec7005529f6635e90adc81885b51.exe	notepad.exe
PID 1844 wrote to memory of 1664	1844	45466bb8c9df944bbe1ec77042ccb91a7ab7ec7005529f6635e90adc81885b51.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\45466bb8c9df944bbe1ec77042ccb91a7ab7ec7005529f6635e90adc81885b51.exe
"C:\Users\Admin\AppData\Local\Temp\45466bb8c9df944bbe1ec77042ccb91a7ab7ec7005529f6635e90adc81885b51.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1844

memory/1664-0-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/1664-1-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download