Overview

overview

10

Static

static

3

6aab6add0b...ea.exe

windows7-x64

10

6aab6add0b...ea.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/11/2024, 02:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    6aab6add0be01028b85e7f76ffb19e6cdfb471a2901b9fbb44be239b3fc593ea.exe
  • Size 12.8MB
  • Sample241102-dgwzeazmar
  • SHA256 6aab6add0be01028b85e7f76ffb19e6cdfb471a2901b9fbb44be239b3fc593ea
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
metasploitbackdoortrojan

Malware Config

Extracted

Family

  • metasploit

Version

  • metasploit_stager

C2

  • 192.168.240.129:7777

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • Metasploit family
    metasploit
  • Loads dropped DLL 31 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6aab6add0be01028b85e7f76ffb19e6cdfb471a2901b9fbb44be239b3fc593ea.exe
    "C:\Users\Admin\AppData\Local\Temp\6aab6add0be01028b85e7f76ffb19e6cdfb471a2901b9fbb44be239b3fc593ea.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3444
    • C:\Users\Admin\AppData\Local\Temp\6aab6add0be01028b85e7f76ffb19e6cdfb471a2901b9fbb44be239b3fc593ea.exe
      "C:\Users\Admin\AppData\Local\Temp\6aab6add0be01028b85e7f76ffb19e6cdfb471a2901b9fbb44be239b3fc593ea.exe"
      2⤵
      • Loads dropped DLL
      PID:2052

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\VCRUNTIME140.dll
        • Size 91KB
        • SHA256 8ee6b49830436ff3bec9ba89213395427b5535813930489f118721fd3d2d942c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\_bz2.pyd
        • Size 85KB
        • SHA256 d6e5763cecd267be0ff5355ff53e93428f3dd7ab20458fb1e7432dffa060cf82
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _cffi_backend.cp38-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\_cffi_backend.cp38-win_amd64.pyd
        • Size 173KB
        • SHA256 3df50b1e9fadc6d006c712d2a80a96ae0a286efd82f9a4160439c75d2be4d7b4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\_ctypes.pyd
        • Size 123KB
        • SHA256 64f5072cd9536418ec0fd4b5c30c13b03cdddced1f9332d4d721c4b37ae3883e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\_decimal.pyd
        • Size 262KB
        • SHA256 c2241fc45e94e2950c7bceaa097c3fafbc0e8e764bf2869ea5e27ebf4829a619
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\_hashlib.pyd
        • Size 46KB
        • SHA256 46d3016b73ecf3713228df563971feefcbebcea9925349a0807b48f0e09877ce
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\_lzma.pyd
        • Size 159KB
        • SHA256 d7acc95049c07298af56a316419e6548f3e6b56fb22dfb3382607a803dddb5e0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _multiprocessing.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\_multiprocessing.pyd
        • Size 29KB
        • SHA256 e8cadcff45d99f3cd0a868a112c24a54477e91c3b5a53d0afedeb15a03f8180b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-console-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-core-console-l1-1-0.dll
        • Size 20KB
        • SHA256 191e08dea0ad5ac02e7e84669d9fffa5aa67dc696e36077c5fa20d81c80b6a56
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-datetime-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-core-datetime-l1-1-0.dll
        • Size 20KB
        • SHA256 a94b80a5111aabefb1309609abdd300bb626d861cd8e0938b9735ab711a43c22
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-debug-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-core-debug-l1-1-0.dll
        • Size 20KB
        • SHA256 263e038363527b7bed05110f37f7e5b95f82aab9c0280c9c522cf7bfce10fd7d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-errorhandling-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-core-errorhandling-l1-1-0.dll
        • Size 20KB
        • SHA256 085968d938ea924827c4740697713674850218a8fe91dd9982e93b0effacc820
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-fibers-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-core-fibers-l1-1-0.dll
        • Size 20KB
        • SHA256 c86ebc9f48e2db659e80d9c7ad5f29e6b6c850eea58813c041baeff496ae4f18
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-file-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-core-file-l1-1-0.dll
        • Size 24KB
        • SHA256 120c3afed9ce2a981c61208757fca0665f43926751ec8d0d13e10ef1096a0d48
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-file-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-core-file-l1-2-0.dll
        • Size 20KB
        • SHA256 0dc1f695befddb8ee52a308801410f2f1d115fc70668131075c2dbcfa0b6f9a0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-file-l2-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-core-file-l2-1-0.dll
        • Size 20KB
        • SHA256 18655793b4d489f769327e3c8710aced6b763c7873b6a8dc5ae6f28d228647f4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-handle-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-core-handle-l1-1-0.dll
        • Size 20KB
        • SHA256 7e45a1b997331f4d038f847f205904d6ec703df7a8c5c660435697e318ced8fc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-heap-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-core-heap-l1-1-0.dll
        • Size 20KB
        • SHA256 dd1e8c77002685629c5cd569ee17f9aa2bcb2e59d41b76ae5bc751cae26d75bf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-interlocked-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-core-interlocked-l1-1-0.dll
        • Size 20KB
        • SHA256 ea60d03a35ef2c50306dbbd1ad408c714b1548035c615359af5a7ce8c0bd14a8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-libraryloader-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-core-libraryloader-l1-1-0.dll
        • Size 20KB
        • SHA256 929298566ba01d1c3e64356a1f8370c1e97f0599f56f823c508cde9ae17f130b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-localization-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-core-localization-l1-2-0.dll
        • Size 20KB
        • SHA256 dc570708327c4c8419d4cced2a162d7ca112a168301134dd1fb5e2040eee45b6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-memory-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-core-memory-l1-1-0.dll
        • Size 20KB
        • SHA256 8a4b66cea7b474506fbdbe4c45e78923645f5f0a13f7f4e43449649f50ea38b8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-namedpipe-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-core-namedpipe-l1-1-0.dll
        • Size 20KB
        • SHA256 e8382a73730c2f7f873b40e2fcc5e1cd4847e7cb42fef3c76bea183af5891d65
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-processenvironment-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-core-processenvironment-l1-1-0.dll
        • Size 20KB
        • SHA256 9c1afc7cd0b0e0d136d09b65dd082ace136fc306f8f116f3d13956211ec146c8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-processthreads-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-core-processthreads-l1-1-0.dll
        • Size 20KB
        • SHA256 6e5bd110a2f4dc345b68e9a8fb081783586c8c25f46027c58443ade2d3e1bf01
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-processthreads-l1-1-1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-core-processthreads-l1-1-1.dll
        • Size 20KB
        • SHA256 19b018be16afe143fb107ef1dd5b8e6c6cb45966806eb3d31ec09ff0dc2b70d1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-profile-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-core-profile-l1-1-0.dll
        • Size 20KB
        • SHA256 cc3c609193f2e99f80a6a21064d10c5c591101e386338879326775ccdd77dcb6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-rtlsupport-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-core-rtlsupport-l1-1-0.dll
        • Size 20KB
        • SHA256 bcb9a6dd2cc0caaa700d95fa3af5163a8246388c2efefbbc4cf6e1fe2687c72e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-string-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-core-string-l1-1-0.dll
        • Size 20KB
        • SHA256 9b071b842445a5dd90148445af148d024674085927d079864f7893807fd1b305
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-synch-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-core-synch-l1-1-0.dll
        • Size 20KB
        • SHA256 a981a24c9231e0230031bb1cba8f2509565ece1f53ebdb4d0a50efd722ab4330
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-synch-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-core-synch-l1-2-0.dll
        • Size 20KB
        • SHA256 69dd52caffe1ea6e0900fb9604a57a87618f8468dc68cbb2a9bcefd1265f3f49
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-sysinfo-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-core-sysinfo-l1-1-0.dll
        • Size 20KB
        • SHA256 3513cffa44c88ec13d6a8c9b63e5d505a131b46746d13ee654144f08a96f20c3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-timezone-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-core-timezone-l1-1-0.dll
        • Size 20KB
        • SHA256 24f4530debf2161e0d0256f923b836aeccc3278a6ff2c9400e415600276b5a6d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-util-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-core-util-l1-1-0.dll
        • Size 20KB
        • SHA256 2e1cc12f93837a4e1fe95e0c640b147be29793705628f9c6cd91a0b5c0c50262
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-conio-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-crt-conio-l1-1-0.dll
        • Size 20KB
        • SHA256 1368b9af85f186a2b35e2a744eb2103555234b32fdfbfdb94c0f5e525c588e46
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-convert-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-crt-convert-l1-1-0.dll
        • Size 24KB
        • SHA256 2ccb01b62188ddc051a582c128bf880608111c602534e487ec09a7cf67c22d17
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-environment-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-crt-environment-l1-1-0.dll
        • Size 20KB
        • SHA256 5a2ae5b270c1eaf467878e7f5dbdc689b71914bdf30293d7d46c01d9dd11bdd4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-filesystem-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-crt-filesystem-l1-1-0.dll
        • Size 20KB
        • SHA256 42a99227775e85ca8c197811a86aad0e2af496bd21623e4c9a2dd747571c8990
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-heap-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-crt-heap-l1-1-0.dll
        • Size 20KB
        • SHA256 43c80120970be1efed3ea60bf7aa37b46fcce946b94fb11ca6e3ffff2f16bb29
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-locale-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-crt-locale-l1-1-0.dll
        • Size 20KB
        • SHA256 6011ece89f4833dcb4cefb02ea366b828725205eae6f25ab704b76fd9e5d86eb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-math-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-crt-math-l1-1-0.dll
        • Size 28KB
        • SHA256 5ba8f9c2842990ccdb447fc6d22023103b03f5387f341d3375809f060b5bb4ef
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-multibyte-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-crt-multibyte-l1-1-0.dll
        • Size 28KB
        • SHA256 77328a716589be3c3bcf1f3d3134b4ad050380f504dbc1a3fa076380d77ed0f8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-process-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-crt-process-l1-1-0.dll
        • Size 20KB
        • SHA256 cfc12dd7c1deabf35c8e0fbe01248171c49555fe2d1bed72c5fdba2102090870
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-runtime-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-crt-runtime-l1-1-0.dll
        • Size 24KB
        • SHA256 698fa887c5b994375c9271222e21d0d4c74810e73d377ad898927549fb69dcb3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-stdio-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-crt-stdio-l1-1-0.dll
        • Size 24KB
        • SHA256 c1541ed4dc6879a136bf532393f7cefd3c48ad371d2ed9965e7cbd44c87a1137
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-string-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-crt-string-l1-1-0.dll
        • Size 24KB
        • SHA256 4429b8e6707645fb503ebc3bd50ce2a84f559b6a2ed778196835808bdfec2f48
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-time-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-crt-time-l1-1-0.dll
        • Size 20KB
        • SHA256 f3e6f692cec86adb3985b929345c731469777aeaeb088e3ce070957df481f924
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-utility-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\api-ms-win-crt-utility-l1-1-0.dll
        • Size 20KB
        • SHA256 6c78d4aba91877c5bb33e545b6a69a818f377e07ff62e791b804fa5b4d2bcf02
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\base_library.zip
        • Size 824KB
        • SHA256 738fdc2b7fb6ceed56b76a6d137cbebb2ee6fdbcce987653c5bc08fb0718ed06
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\libcrypto-1_1.dll
        • Size 3.2MB
        • SHA256 00a1eeb37372d11559bf44c9e68af9c841c41c95a173f3dfec4e0b5923d0cae0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\libffi-7.dll
        • Size 32KB
        • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\libssl-1_1.dll
        • Size 673KB
        • SHA256 1b57a201184559164dedbddcb43bb110a18cafa19ea3d00fc23274ccfc420e94
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\pyexpat.pyd
        • Size 185KB
        • SHA256 07b0a4831cf64ed352b39a4e874babd7cc705ddc42fdca27d699934d2e2a59d4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        python38.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\python38.dll
        • Size 4.0MB
        • SHA256 560a6a5f8b7afa99600cc47da26a802c342d7f50ffe23850372f2fcf536cd26f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\select.pyd
        • Size 27KB
        • SHA256 bb81d220db83d5276fccda137d430160b8eafd40f4d92d86ebc718b4dfd555ac
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\ucrtbase.dll
        • Size 1.1MB
        • SHA256 d2ebd8719455ae4634d00fd0d0eb0c3ad75054fee4ff545346a1524e5d7e3a66
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34442\unicodedata.pyd
        • Size 1.0MB
        • SHA256 e5ebcc99f94766951bb75731afe07b7c4481e7ff3d252f21d39ddea7c8da4147
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/2052-192-0x0000026D2F290000-0x0000026D2F291000-memory.dmp
        Download