metasploit | 2bf1f0dca95be633801cfc07d0107db8e891133586c0cbbbc9206edc0f00a02b

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 09:25

Target

2bf1f0dca95be633801cfc07d0107db8e891133586c0cbbbc9206edc0f00a02b.dll
Size

9.5MB
MD5

3e81bd54974f47892924dda600d81fc1
SHA1

1fdd4da4e058f3d2a9d503a48572c816611bebce
SHA256

2bf1f0dca95be633801cfc07d0107db8e891133586c0cbbbc9206edc0f00a02b
SHA512

04cafc7bd853ea08dbbbf226fe43e6d4dc1489415d9145eb1824e7a5cd705a74c6323be179dd5b5494f33dd450465a908b3a89ef6f0c7950b608bf74c4959c87
SSDEEP

196608:yR30oCN9nA5lbrb3fb6yTonobM9aX2cbZGKQcaCnNPDGwGus:AweXDfbRYoX2cbSNw7Gwrs

Score

10^/10

Family

metasploit

Version

windows/reverse_tcp

192.168.239.128:6666

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 2932 set thread context of 2756 2932 rundll32.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

2932 rundll32.exe

description	pid	process	target process
PID 2932 set thread context of 2756	2932	rundll32.exe	rundll32.exe

pid	process
2932	rundll32.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2872 wrote to memory of 2932	2872	rundll32.exe	rundll32.exe
PID 2872 wrote to memory of 2932	2872	rundll32.exe	rundll32.exe
PID 2872 wrote to memory of 2932	2872	rundll32.exe	rundll32.exe
PID 2872 wrote to memory of 2932	2872	rundll32.exe	rundll32.exe
PID 2872 wrote to memory of 2932	2872	rundll32.exe	rundll32.exe
PID 2872 wrote to memory of 2932	2872	rundll32.exe	rundll32.exe
PID 2872 wrote to memory of 2932	2872	rundll32.exe	rundll32.exe
PID 2932 wrote to memory of 2756	2932	rundll32.exe	rundll32.exe
PID 2932 wrote to memory of 2756	2932	rundll32.exe	rundll32.exe
PID 2932 wrote to memory of 2756	2932	rundll32.exe	rundll32.exe
PID 2932 wrote to memory of 2756	2932	rundll32.exe	rundll32.exe
PID 2932 wrote to memory of 2756	2932	rundll32.exe	rundll32.exe
PID 2932 wrote to memory of 2756	2932	rundll32.exe	rundll32.exe
PID 2932 wrote to memory of 2756	2932	rundll32.exe	rundll32.exe
PID 2932 wrote to memory of 2756	2932	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bf1f0dca95be633801cfc07d0107db8e891133586c0cbbbc9206edc0f00a02b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2872

memory/2756-7-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2756-10-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2932-6-0x0000000072AF5000-0x0000000073015000-memory.dmp

Filesize
5.1MB

Download
memory/2932-5-0x0000000072AF0000-0x0000000073996000-memory.dmp

Filesize
14.6MB

Download
memory/2932-4-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2932-2-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2932-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2932-8-0x0000000072AF5000-0x0000000073015000-memory.dmp

Filesize
5.1MB

Download
memory/2932-9-0x0000000072AF0000-0x0000000073996000-memory.dmp

Filesize
14.6MB

Download