metasploit | 200313f8986be06d44f48bd3a17b8aa41bf1896156c3e787f229990af275ad40

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02-07-2024 00:55

Target

200313f8986be06d44f48bd3a17b8aa41bf1896156c3e787f229990af275ad40_NeikiAnalytics.exe
Size

72KB
MD5

c6a51a5f1d33e742d77ec22edbd00a40
SHA1

b37b666c751977018f43c01f934c7770b8d0c54c
SHA256

200313f8986be06d44f48bd3a17b8aa41bf1896156c3e787f229990af275ad40
SHA512

3acd425f76fdf1f8c2dc1c9166a31ca7af527296607c4cba9a5321aae130a3032c28fa9a978c30d8ba65b549a934ae3533de050f1e154aa423fa0d06069eef96
SSDEEP

1536:ILTYdVOXox5KtNuEzzy45xD3uqBGMb+KR0Nc8QsJq39:u4x4i+Ge0Nc8QsC9

Score

10^/10

Family

metasploit

Version

windows/exec

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

200313f8986be06d44f48bd3a17b8aa41bf1896156c3e787f229990af275ad40_NeikiAnalytics.exe

description	pid	process	target process
PID 3580 wrote to memory of 3596	3580	200313f8986be06d44f48bd3a17b8aa41bf1896156c3e787f229990af275ad40_NeikiAnalytics.exe	cmd.exe
PID 3580 wrote to memory of 3596	3580	200313f8986be06d44f48bd3a17b8aa41bf1896156c3e787f229990af275ad40_NeikiAnalytics.exe	cmd.exe
PID 3580 wrote to memory of 3596	3580	200313f8986be06d44f48bd3a17b8aa41bf1896156c3e787f229990af275ad40_NeikiAnalytics.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\200313f8986be06d44f48bd3a17b8aa41bf1896156c3e787f229990af275ad40_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\200313f8986be06d44f48bd3a17b8aa41bf1896156c3e787f229990af275ad40_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3580

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C echo 'OS{f15908d9785898c7d504df48b4836a2e}'
2⤵
PID:3596

memory/3580-0-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download