metasploit | 57cf7d7537c6622ceeb9d0326be3af48dd4f3095fb6e2998db49616e450c7a74 | Triage

Analysis

max time kernel
437s
max time network
438s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
24-12-2024 00:39

Sharing

Report Analysis Logs

General

Target

RjvPlatform.dll
Size

9KB
MD5

42c0eca6e4092da7b58ad45699f99bfe
SHA1

ecdd424aca025a4b57750955298b3ef3995c057e
SHA256

57cf7d7537c6622ceeb9d0326be3af48dd4f3095fb6e2998db49616e450c7a74
SHA512

6687f477b891e00417cb9fd4c2ca557a659cf8599dcc9c0ed67b1ba3f6fe8787cb48ee5c082c1a25dccd45fb7a3e649e5471eb4de7bfbfd4502c7453fceb895b
SSDEEP

48:q0r+l6O5aXyn/hNhx4/jC/VcQkSD9C2zRb0E:dX02Qj5P

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

metasploit_stager

C2

213.152.165.29:9500

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Blocklisted process makes network request 10 IoCs

flow	pid	Process
2	4552	rundll32.exe
2	4552	rundll32.exe
2	4552	rundll32.exe
2	4552	rundll32.exe
2	4552	rundll32.exe
2	4552	rundll32.exe
2	4552	rundll32.exe
2	4552	rundll32.exe
2	4552	rundll32.exe
2	4552	rundll32.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2916 set thread context of 4552	2916	rundll32.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 4552	2916	rundll32.exe	81
PID 2916 wrote to memory of 4552	2916	rundll32.exe	81
PID 2916 wrote to memory of 4552	2916	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\RjvPlatform.dll,#1
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\system32\rundll32.exe
  rundll32.exe
  2⤵
  - Blocklisted process makes network request
  PID:4552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4552-0-0x0000025BDBB70000-0x0000025BDBB71000-memory.dmp

Filesize
4KB

Download