metasploit | deb336e0992d49f57fcc9966485dee718b8da4e178ad3bb618984f59e343dd91

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 19:39

Target

deb336e0992d49f57fcc9966485dee718b8da4e178ad3bb618984f59e343dd91.exe
Size

165KB
MD5

cd2cdb25acacebc2664ea201138cfefe
SHA1

8c0109d840fbfde8ed7924f652b5d5b98aac9ebd
SHA256

deb336e0992d49f57fcc9966485dee718b8da4e178ad3bb618984f59e343dd91
SHA512

39183b8c166c9d755ba945b0a661e573d604e1e972483f5e5ceae065024d4451425a8a5de59ac1fb6fc9c9853ca4428cdd0e0ceabc3192715e65f93d0df3d220
SSDEEP

3072:Yf+GYrgxI0c5XI/NklH0iNL2Sl8BJoNEWoY46UolkeERh:ndr0I0c5XICuiNLnluOdohPolWR

Score

10^/10

Family

metasploit

Version

metasploit_stager

192.168.248.128:4444

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Executes dropped EXE 1 IoCs

pid	Process
3000	irfrg.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 3000	3268	deb336e0992d49f57fcc9966485dee718b8da4e178ad3bb618984f59e343dd91.exe
PID 3268 wrote to memory of 3000	3268	deb336e0992d49f57fcc9966485dee718b8da4e178ad3bb618984f59e343dd91.exe	84

C:\Users\Admin\AppData\Local\Temp\deb336e0992d49f57fcc9966485dee718b8da4e178ad3bb618984f59e343dd91.exe
"C:\Users\Admin\AppData\Local\Temp\deb336e0992d49f57fcc9966485dee718b8da4e178ad3bb618984f59e343dd91.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3268
- \Users\Admin\AppData\Local\Temp\irfrg.exe
  2⤵
  - Executes dropped EXE
  PID:3000

C:\Users\Admin\AppData\Local\Temp\irfrg.exe

Filesize
27KB

MD5
5da8c98136d98dfec4716edd79c7145f

SHA1
ed13af4a0a754b8daee4929134d2ff15ebe053cd

SHA256
58189cbd4e6dc0c7d8e66b6a6f75652fc9f4afc7ce0eba7d67d8c3feb0d5381f

SHA512
6e2b067760ec178cdcc4df04c541ce6940fc2a0cdd36f57f4d6332e38119dbc5e24eb67c11d2c8c8ffeed43533c2dd8b642d2c7c997c392928091b5ccce7582a

Download Submit
memory/3000-2-0x00000182A7890000-0x00000182A7891000-memory.dmp

Filesize
4KB

Download