metasploit | 0790e5965afd9e56324496ab26c1113a09b961ae445632c6f7b6a6e797c37cf1

Analysis

max time kernel
148s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 10:45

Target

0790e5965afd9e56324496ab26c1113a09b961ae445632c6f7b6a6e797c37cf1_NeikiAnalytics.exe
Size

261KB
MD5

3776a56bead90b28c781a8dd2a716fb0
SHA1

b973a1497f3fbed61d12c3ab6ca042718f508f16
SHA256

0790e5965afd9e56324496ab26c1113a09b961ae445632c6f7b6a6e797c37cf1
SHA512

9bc20cfdcb419f37cfec610b7a2df5cc9778e77c0ca1d8f4e03578a77456473aba8aabbcf2cb7595de87111c840ecbc18ca5e1f220c31f29b16d8b80e51f1b1c
SSDEEP

3072:2OZ3MBLhTb01yNjhnRwEHQEwMbQkppfwst8jwJmKNrQW6ldVEOEcR1QuRSlH4u:2OZ4hX01yNjhGEw5M0sX8jR4Ylrq4

Score

10^/10

Family

metasploit

Version

metasploit_stager

192.168.56.114:443

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Suspicious use of SetThreadContext 1 IoCs

Processes:

0790e5965afd9e56324496ab26c1113a09b961ae445632c6f7b6a6e797c37cf1_NeikiAnalytics.exe

description pid process target process

PID 3300 set thread context of 3932 3300 0790e5965afd9e56324496ab26c1113a09b961ae445632c6f7b6a6e797c37cf1_NeikiAnalytics.exe msedge.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

0790e5965afd9e56324496ab26c1113a09b961ae445632c6f7b6a6e797c37cf1_NeikiAnalytics.exe

pid process

3300 0790e5965afd9e56324496ab26c1113a09b961ae445632c6f7b6a6e797c37cf1_NeikiAnalytics.exe
3300 0790e5965afd9e56324496ab26c1113a09b961ae445632c6f7b6a6e797c37cf1_NeikiAnalytics.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

0790e5965afd9e56324496ab26c1113a09b961ae445632c6f7b6a6e797c37cf1_NeikiAnalytics.exe

pid process

3300 0790e5965afd9e56324496ab26c1113a09b961ae445632c6f7b6a6e797c37cf1_NeikiAnalytics.exe

description	pid	process	target process
PID 3300 set thread context of 3932	3300	0790e5965afd9e56324496ab26c1113a09b961ae445632c6f7b6a6e797c37cf1_NeikiAnalytics.exe	msedge.exe

pid	process
3300	0790e5965afd9e56324496ab26c1113a09b961ae445632c6f7b6a6e797c37cf1_NeikiAnalytics.exe
3300	0790e5965afd9e56324496ab26c1113a09b961ae445632c6f7b6a6e797c37cf1_NeikiAnalytics.exe

pid	process
3300	0790e5965afd9e56324496ab26c1113a09b961ae445632c6f7b6a6e797c37cf1_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

0790e5965afd9e56324496ab26c1113a09b961ae445632c6f7b6a6e797c37cf1_NeikiAnalytics.exe

description	pid	process	target process
PID 3300 wrote to memory of 3932	3300	0790e5965afd9e56324496ab26c1113a09b961ae445632c6f7b6a6e797c37cf1_NeikiAnalytics.exe	msedge.exe
PID 3300 wrote to memory of 3932	3300	0790e5965afd9e56324496ab26c1113a09b961ae445632c6f7b6a6e797c37cf1_NeikiAnalytics.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-start-up-window --win-session-start /prefetch:5
2⤵
PID:3932

memory/3300-0-0x00007FFCC9890000-0x00007FFCC9A85000-memory.dmp

Filesize
2.0MB

Download
memory/3932-1-0x0000020482FF0000-0x0000020482FF1000-memory.dmp

Filesize
4KB

Download