metasploit | d3924df7496deae0c2afc053045e892f3008619a2d9e3608671ec6314df35be8

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
05/12/2024, 17:05

Target

d3924df7496deae0c2afc053045e892f3008619a2d9e3608671ec6314df35be8.exe
Size

258KB
MD5

e0534feb7f3955c85d04023941f8bd1f
SHA1

de93da27d7d79ddca16cb031a59bbf49e278d71f
SHA256

d3924df7496deae0c2afc053045e892f3008619a2d9e3608671ec6314df35be8
SHA512

27e25b9f41b112ac030a7b23a8515d598a07b671f2c306049ee440f71f424e6f6137b1713c6e76416215af3bde3654cec15a7b425b5aa03c2a275db0e940ddf6
SSDEEP

6144:uZv0TIJu+3GXNHTM9gaxRTKp9dm2ua7jZiX+pJLh6:u2Tf+2dzMe2Kua7MX+r6

Score

10^/10

Family

metasploit

Version

windows/download_exec

http://192.168.239.129:17822/RnXD

Attributes

headers User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; MASAJS)

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 1800	2064	d3924df7496deae0c2afc053045e892f3008619a2d9e3608671ec6314df35be8.exe	30
PID 2064 wrote to memory of 1800	2064	d3924df7496deae0c2afc053045e892f3008619a2d9e3608671ec6314df35be8.exe	30
PID 2064 wrote to memory of 1800	2064	d3924df7496deae0c2afc053045e892f3008619a2d9e3608671ec6314df35be8.exe	30

C:\Users\Admin\AppData\Local\Temp\d3924df7496deae0c2afc053045e892f3008619a2d9e3608671ec6314df35be8.exe
"C:\Users\Admin\AppData\Local\Temp\d3924df7496deae0c2afc053045e892f3008619a2d9e3608671ec6314df35be8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2064 -s 60
  2⤵
  PID:1800

memory/2064-0-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/2064-1-0x000000013F9B0000-0x000000013F9F9000-memory.dmp

Filesize
292KB

Download