metasploit | 2bf1f0dca95be633801cfc07d0107db8e891133586c0cbbbc9206edc0f00a02b

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 09:25

Target

2bf1f0dca95be633801cfc07d0107db8e891133586c0cbbbc9206edc0f00a02b.dll
Size

9.5MB
MD5

3e81bd54974f47892924dda600d81fc1
SHA1

1fdd4da4e058f3d2a9d503a48572c816611bebce
SHA256

2bf1f0dca95be633801cfc07d0107db8e891133586c0cbbbc9206edc0f00a02b
SHA512

04cafc7bd853ea08dbbbf226fe43e6d4dc1489415d9145eb1824e7a5cd705a74c6323be179dd5b5494f33dd450465a908b3a89ef6f0c7950b608bf74c4959c87
SSDEEP

196608:yR30oCN9nA5lbrb3fb6yTonobM9aX2cbZGKQcaCnNPDGwGus:AweXDfbRYoX2cbSNw7Gwrs

Score

10^/10

Family

metasploit

Version

windows/reverse_tcp

192.168.239.128:6666

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 3020 set thread context of 1452 3020 rundll32.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

3020 rundll32.exe
3020 rundll32.exe

description	pid	process	target process
PID 3020 set thread context of 1452	3020	rundll32.exe	rundll32.exe

pid	process
3020	rundll32.exe
3020	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2876 wrote to memory of 3020	2876	rundll32.exe	rundll32.exe
PID 2876 wrote to memory of 3020	2876	rundll32.exe	rundll32.exe
PID 2876 wrote to memory of 3020	2876	rundll32.exe	rundll32.exe
PID 3020 wrote to memory of 1452	3020	rundll32.exe	rundll32.exe
PID 3020 wrote to memory of 1452	3020	rundll32.exe	rundll32.exe
PID 3020 wrote to memory of 1452	3020	rundll32.exe	rundll32.exe
PID 3020 wrote to memory of 1452	3020	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bf1f0dca95be633801cfc07d0107db8e891133586c0cbbbc9206edc0f00a02b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2876

memory/1452-5-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/3020-0-0x0000000000980000-0x0000000000981000-memory.dmp

Filesize
4KB

Download
memory/3020-2-0x0000000073F05000-0x0000000074425000-memory.dmp

Filesize
5.1MB

Download
memory/3020-1-0x0000000073F00000-0x0000000074DA6000-memory.dmp

Filesize
14.6MB

Download
memory/3020-3-0x0000000073F05000-0x0000000074425000-memory.dmp

Filesize
5.1MB

Download
memory/3020-4-0x0000000073F00000-0x0000000074DA6000-memory.dmp

Filesize
14.6MB

Download