metasploit | 18ba6cd59749904247bade4b75429e2ac2c4ee2a6fe206ebd114e89283f8f5db

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24-09-2024 11:14

Target

e9dc029457e9d23c8db988c4c0585bfa.exe
Size

31KB
MD5

e9dc029457e9d23c8db988c4c0585bfa
SHA1

3d670aa59c97d831e5097b69734b994bf4144cbb
SHA256

18ba6cd59749904247bade4b75429e2ac2c4ee2a6fe206ebd114e89283f8f5db
SHA512

3a6138fd199b3cd0a12f4a1ca193823b32afa557a3d7af5e279cc96edb3fcab31fcf6bbff357d089331f47a295e83222f17a45be3dd4254de88b06bf98f379a9
SSDEEP

192:+np66k5gQDVAU3l6+eKdv3Zn4TJrJfsQ5XfDcyLwaBg1+Cfs2LzwYDK7UlVSq7j4:GO/5AwJtZ4RFskLt

Score

10^/10

Family

metasploit

Version

metasploit_stager

124.221.70.199:8983

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2784	e9dc029457e9d23c8db988c4c0585bfa.exe
2784	e9dc029457e9d23c8db988c4c0585bfa.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3412	Explorer.EXE
Token: SeCreatePagefilePrivilege	3412	Explorer.EXE
Token: SeShutdownPrivilege	3412	Explorer.EXE
Token: SeCreatePagefilePrivilege	3412	Explorer.EXE
Token: SeShutdownPrivilege	3412	Explorer.EXE
Token: SeCreatePagefilePrivilege	3412	Explorer.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 3412	2784	e9dc029457e9d23c8db988c4c0585bfa.exe	55

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3412
- C:\Users\Admin\AppData\Local\Temp\e9dc029457e9d23c8db988c4c0585bfa.exe
  "C:\Users\Admin\AppData\Local\Temp\e9dc029457e9d23c8db988c4c0585bfa.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3836,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:8
1⤵
PID:1856

memory/3412-0-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Filesize
4KB

Download
memory/3412-1-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Filesize
4KB

Download