metasploit | 4d234c2492c20f209c48c5d1314eb9218cd65efd674b28e2f93d8bd7adde35f4

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-11-2024 15:09

Target

2024-11-24_c64c3bd487b6d1d34a7cf2ac077ba19c_cobalt-strike_megazord.exe
Size

11.1MB
MD5

c64c3bd487b6d1d34a7cf2ac077ba19c
SHA1

73481bf10b2658305ca5263788b44f85f5843371
SHA256

4d234c2492c20f209c48c5d1314eb9218cd65efd674b28e2f93d8bd7adde35f4
SHA512

f267ac6b60df583447dd4a798695ce4eccd87f3d3a88c101c988de2c1df691e55ec6b9188d4cbd63f4b0894f1f430bdb23b082e05040ebd7bbadff05160084a2
SSDEEP

98304:HNty57QQPujFFL7PBVOoAABT12NoF2GOZcr/ktiDJWt5dZ/Zvh:HNO2/ZVOoAABOowGwXwVWt5dt

Score

10^/10

Family

metasploit

Version

encoder/shikata_ga_nai

Family

metasploit

Version

metasploit_stager

192.168.1.150:4444

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2252	1720	2024-11-24_c64c3bd487b6d1d34a7cf2ac077ba19c_cobalt-strike_megazord.exe	32
PID 1720 wrote to memory of 2252	1720	2024-11-24_c64c3bd487b6d1d34a7cf2ac077ba19c_cobalt-strike_megazord.exe	32
PID 1720 wrote to memory of 2252	1720	2024-11-24_c64c3bd487b6d1d34a7cf2ac077ba19c_cobalt-strike_megazord.exe	32
PID 1720 wrote to memory of 2252	1720	2024-11-24_c64c3bd487b6d1d34a7cf2ac077ba19c_cobalt-strike_megazord.exe	32

C:\Users\Admin\AppData\Local\Temp\2024-11-24_c64c3bd487b6d1d34a7cf2ac077ba19c_cobalt-strike_megazord.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-24_c64c3bd487b6d1d34a7cf2ac077ba19c_cobalt-strike_megazord.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- \??\c:\windows\system32\svchost.exe
  c:\windows\system32\svchost.exe
  2⤵
  PID:2252

memory/1720-0-0x00000001400C9000-0x00000001400CA000-memory.dmp

Filesize
4KB

Download
memory/2252-1-0x00000000FF320000-0x00000000FF32B000-memory.dmp

Filesize
44KB

Download