metasploit | 5407e6ece7662604d7396f62fda11798738c8be2a2b722c990c398adacbb1779 | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 02:16

Sharing

Report Analysis Logs

General

Target

4d243021e90bd0418987cd20ea88f440N.exe
Size

72KB
MD5

4d243021e90bd0418987cd20ea88f440
SHA1

2239a030344595de505abdac491702cc59b9134a
SHA256

5407e6ece7662604d7396f62fda11798738c8be2a2b722c990c398adacbb1779
SHA512

07f492f935c5b4442bf8d89c32329ed53fdd10dd447f3cd2e7dc008a53a6e4fef6dc7d418ad045ff1f87f53317b6ed798e46313ae765e22c58f572ca9d55fa6a
SSDEEP

1536:ILTYdVOXog5KtNuEzzy45xD3uqBGMb+KR0Nc8QsJq39:u4g4i+Ge0Nc8QsC9

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

windows/exec

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2384	1952	4d243021e90bd0418987cd20ea88f440N.exe	30
PID 1952 wrote to memory of 2384	1952	4d243021e90bd0418987cd20ea88f440N.exe	30
PID 1952 wrote to memory of 2384	1952	4d243021e90bd0418987cd20ea88f440N.exe	30
PID 1952 wrote to memory of 2384	1952	4d243021e90bd0418987cd20ea88f440N.exe	30

C:\Users\Admin\AppData\Local\Temp\4d243021e90bd0418987cd20ea88f440N.exe
"C:\Users\Admin\AppData\Local\Temp\4d243021e90bd0418987cd20ea88f440N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C echo 'OS{8e2fdb6ba0383ad85d0937bbb7f21186}'
  2⤵
  PID:2384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1952-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download