metasploit | 5e2abea822274f143ae7054b5f2fc8a7d98786e34e1eda53fcbf1715a9943aa4 | Triage

Analysis

max time kernel
105s
max time network
115s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-09-2024 11:45

Sharing

Report Analysis Logs

General

Target

2fa06de6f263e8df389a88e838933b40N.dll
Size

104KB
MD5

2fa06de6f263e8df389a88e838933b40
SHA1

038370d28f779436a3f5cdd35eb53a46ac537ebf
SHA256

5e2abea822274f143ae7054b5f2fc8a7d98786e34e1eda53fcbf1715a9943aa4
SHA512

a40e5fa7b657b265fe29f44786231be1605f8c6f9b66b2c5fa661b609b30bf0818bc891d4b1ab1c4d464347c1a492551a2ca1d07c26a3c4709dc393ee742164f
SSDEEP

3072:9hPd/e0Jo5pXBSnV3XKJMblIczuSoxZW:z5etLRSntCS

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

metasploit_stager

C2

18.119.108.159:80

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Blocklisted process makes network request 6 IoCs

flow	pid	Process
1	1392	rundll32.exe
1	1392	rundll32.exe
1	1392	rundll32.exe
1	1392	rundll32.exe
1	1392	rundll32.exe
1	1392	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fa06de6f263e8df389a88e838933b40N.dll,#1
1⤵
- Blocklisted process makes network request
PID:1392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1392-0-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download