metasploit | 3803193eff523d185cad40191f9e198f8bfbb945db6fd651b79c17ed7ceeff4a

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
10/11/2024, 04:59

Target

3803193eff523d185cad40191f9e198f8bfbb945db6fd651b79c17ed7ceeff4aN.exe
Size

8KB
MD5

775ffa5605e9f10b6ca6de5d2e457d50
SHA1

40f61d8ac05350599a3f58b72e9c053ab62798a4
SHA256

3803193eff523d185cad40191f9e198f8bfbb945db6fd651b79c17ed7ceeff4a
SHA512

38320309ac76061ab8e2ac70e922a365e154e36930184c8728e8f1c429671ab39afd4a02067f62987d2953ce5bc59df7f0e1466d7f93c4dbbd44bb12f4fc592f
SSDEEP

96:a6VlIAG+fmy0gzK110ZmfAooYSaFfCiQnHSFYgfNXhsIiWo5xF8LnHLJMLzLIzNt:a6VAwQaZmmgaFnH4YgVhszvezFMHW

Score

10^/10

Family

metasploit

Version

metasploit_stager

192.168.163.151:8080

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 320	1736	3803193eff523d185cad40191f9e198f8bfbb945db6fd651b79c17ed7ceeff4aN.exe	32
PID 1736 wrote to memory of 320	1736	3803193eff523d185cad40191f9e198f8bfbb945db6fd651b79c17ed7ceeff4aN.exe	32
PID 1736 wrote to memory of 320	1736	3803193eff523d185cad40191f9e198f8bfbb945db6fd651b79c17ed7ceeff4aN.exe	32
PID 1736 wrote to memory of 320	1736	3803193eff523d185cad40191f9e198f8bfbb945db6fd651b79c17ed7ceeff4aN.exe	32

C:\Users\Admin\AppData\Local\Temp\3803193eff523d185cad40191f9e198f8bfbb945db6fd651b79c17ed7ceeff4aN.exe
"C:\Users\Admin\AppData\Local\Temp\3803193eff523d185cad40191f9e198f8bfbb945db6fd651b79c17ed7ceeff4aN.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- \??\c:\windows\system32\svchost.exe
  c:\windows\system32\svchost.exe
  2⤵
  PID:320

memory/1736-0-0x000007FEF5CB3000-0x000007FEF5CB4000-memory.dmp

Filesize
4KB

Download
memory/1736-1-0x000000013F360000-0x000000013F366000-memory.dmp

Filesize
24KB

Download