metasploit | 6d22d9e2c7a3c3d0063a8faec8dc2adccaff2b834a3fe9a1bb4bad6e43ae91dc

Resubmissions

07-11-2024 15:19

241107-sqffcavcpn 10

26-10-2024 21:50

241026-1pw1pszape 10

26-10-2024 21:43

241026-1k53tazhlq 10

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-10-2024 21:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d22d9e2c7a3c3d0063a8faec8dc2adccaff2b834a3fe9a1bb4bad6e43ae91dc.exe
Size

2.8MB
MD5

e04ecdd8ffdc552a1487fc06fe7b7d32
SHA1

6bbc335e0a245fff6a76609cce91002a9b4fa4da
SHA256

6d22d9e2c7a3c3d0063a8faec8dc2adccaff2b834a3fe9a1bb4bad6e43ae91dc
SHA512

8c7d78d34efcfe4fff5657c2d77fa166e018705e0430472a1ed68404e1e2643dfc1216d1a4e10d6e900409edc301139ebd8513e06f9b1c63721f80ffa2a8e906
SSDEEP

49152:QTv13vUrb/TvvO90dL3BmAFd4A64nsfJ2O4w7mtxwenpxgmM9GgoW0D1/xhN/v38:m3vXR907bN/1XVK

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

metasploit_stager

192.168.65.128:9999

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1452 set thread context of 716	1452	6d22d9e2c7a3c3d0063a8faec8dc2adccaff2b834a3fe9a1bb4bad6e43ae91dc.exe	88

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 716	1452	6d22d9e2c7a3c3d0063a8faec8dc2adccaff2b834a3fe9a1bb4bad6e43ae91dc.exe	88
PID 1452 wrote to memory of 716	1452	6d22d9e2c7a3c3d0063a8faec8dc2adccaff2b834a3fe9a1bb4bad6e43ae91dc.exe	88
PID 1452 wrote to memory of 716	1452	6d22d9e2c7a3c3d0063a8faec8dc2adccaff2b834a3fe9a1bb4bad6e43ae91dc.exe	88
PID 1452 wrote to memory of 716	1452	6d22d9e2c7a3c3d0063a8faec8dc2adccaff2b834a3fe9a1bb4bad6e43ae91dc.exe	88
PID 1452 wrote to memory of 716	1452	6d22d9e2c7a3c3d0063a8faec8dc2adccaff2b834a3fe9a1bb4bad6e43ae91dc.exe	88
PID 1452 wrote to memory of 716	1452	6d22d9e2c7a3c3d0063a8faec8dc2adccaff2b834a3fe9a1bb4bad6e43ae91dc.exe	88
PID 1452 wrote to memory of 716	1452	6d22d9e2c7a3c3d0063a8faec8dc2adccaff2b834a3fe9a1bb4bad6e43ae91dc.exe	88

C:\Users\Admin\AppData\Local\Temp\6d22d9e2c7a3c3d0063a8faec8dc2adccaff2b834a3fe9a1bb4bad6e43ae91dc.exe
"C:\Users\Admin\AppData\Local\Temp\6d22d9e2c7a3c3d0063a8faec8dc2adccaff2b834a3fe9a1bb4bad6e43ae91dc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/716-0-0x00007FF743570000-0x00007FF743575000-memory.dmp

Filesize
20KB

Download
memory/716-6-0x00007FF743570000-0x00007FF743575000-memory.dmp

Filesize
20KB

Download
memory/716-5-0x00007FF743570000-0x00007FF743574278-memory.dmp

Filesize
16KB

Download
memory/716-7-0x00007FF743570000-0x00007FF743574278-memory.dmp

Filesize
16KB

Download