metasploit | f83bee2e9d7c8ead88c3d0b761339bfa232e14803608a17e60582516e6559ae0

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 06:38

Target
d5f8785aedca631c7c8e123dc0e6e35f.dll
Size 8KB
Sample240704-hd2spsyfkn
SHA256 f83bee2e9d7c8ead88c3d0b761339bfa232e14803608a17e60582516e6559ae0
MD5 d5f8785aedca631c7c8e123dc0e6e35f
SHA1 b1e6ad90352e7d170f3f2d7f3dba3691b8ac9884
SHA512 06a9cb9d0690836b8767d848384cc2a994e65da13404a354220e0f7683821babb6647a848a0a5a49cc528721bb1ffcba9d51eae3b5ef9feceeb5ca6e631ed842
SSDEEP 48:qUr3zU9G4aNVhnX5hthMt6dO28xZMEvCHPAPb:+DIibzs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Version

http://89.197.154.116:7810/r0YP8_HZj6Xh9eD0h471LAg3P8LpTQjBwuoVU2_qOmLbrRhD7dzVzwh4X1zqWkGpdfKoeGcDyWqM5Vj7W_USDDh

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Blocklisted process makes network request 10 IoCs

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5092 set thread context of 1992	5092	rundll32.exe	82

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 5092	1544	rundll32.exe	81
PID 1544 wrote to memory of 5092	1544	rundll32.exe	81
PID 1544 wrote to memory of 5092	1544	rundll32.exe	81
PID 5092 wrote to memory of 1992	5092	rundll32.exe	82
PID 5092 wrote to memory of 1992	5092	rundll32.exe	82
PID 5092 wrote to memory of 1992	5092	rundll32.exe	82
PID 5092 wrote to memory of 1992	5092	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d5f8785aedca631c7c8e123dc0e6e35f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d5f8785aedca631c7c8e123dc0e6e35f.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe
    3⤵
    - Blocklisted process makes network request
    PID:1992

memory/1992-0-0x0000000000160000-0x0000000000161000-memory.dmp

Download