metasploit | 2935f78883b74b4f8758fdf0e7b1d49dc5e114189d595ab60040e25e2587ff90

Analysis

max time kernel
31s
max time network
37s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
06-06-2024 18:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

trigger.vbs
Size

7KB
MD5

2026d6fcbafcfd77ebbe047864943156
SHA1

3e5cc28548561728bddd8e6ba33fd799259499b6
SHA256

2935f78883b74b4f8758fdf0e7b1d49dc5e114189d595ab60040e25e2587ff90
SHA512

6bb81ab5beff055c46e74a00e1df042c074e7207cc62846771d5df2eae216edd4c1929f5a7087f8a28d8914cd598f8dc2fff68420385c31f8bfa4233438f3123
SSDEEP

96:l/7/l5e8T+CY0PvBjfpi1nXBFX7g6h6zyCkVU3Ngih00HM4v0GRvMIDucTSNd1:57/lNzVKHGyCkVC08/vMIruNd1

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

109.93.203.238:443

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Executes dropped EXE 1 IoCs

Processes:

WUTJLdUKP.exe

pid process

1528 WUTJLdUKP.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1528	WUTJLdUKP.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

WScript.exe

description	pid	process	target process
PID 2776 wrote to memory of 1528	2776	WScript.exe	WUTJLdUKP.exe
PID 2776 wrote to memory of 1528	2776	WScript.exe	WUTJLdUKP.exe
PID 2776 wrote to memory of 1528	2776	WScript.exe	WUTJLdUKP.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2776

C:\Users\Admin\AppData\Local\Temp\rad40772.tmp\WUTJLdUKP.exe
"C:\Users\Admin\AppData\Local\Temp\rad40772.tmp\WUTJLdUKP.exe"
2⤵
- Executes dropped EXE
PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rad40772.tmp\WUTJLdUKP.exe

Filesize
4KB

MD5
ed1db3b7e6c37a57785e66368256657b

SHA1
b1227aec3587f6488e3babb01bbe96d2badd6feb

SHA256
7ebabf6d48bf1a0a89780af5e8d1bd5cd924338302b74cf27ce9cc9ba54a04f0

SHA512
ee4bc2d4167a109fc003aeaa13354e21381685b0feea92f06991b35a5eb453fb265c508b1110958e798ebff62e0a30630fd7462cff0d7089405f4d7d1fda6a01

Download Submit
memory/1528-4-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1528-6-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download