metasploit | ceba09dc5368ded2d7d5b62bd36fdecbd47aee8f3219abfd2ca32f31b0eba7b0

General

Target
ceba09dc5368ded2d7d5b62bd36fdecbd47aee8f3219abfd2ca32f31b0eba7b0.exe
Size 3.4MB
Sample200908-kdk9ydj296
SHA256 ceba09dc5368ded2d7d5b62bd36fdecbd47aee8f3219abfd2ca32f31b0eba7b0
MD5 97e9bd85aad231de56b05e9872ffb2f6
SHA1 146a1e3d28dc53805af0dc105b4b4d0232dfa1d8
SHA512 1f52e0069586148ce383d9b526fe803e2d8f978a0c8f99b51995172a11c6fda21ba976ea2576053f129d3b0a3f9e8d0be1ae6213cd6a039c52c17fbb853e5f66
MD5 SHA1 SHA512

Score

10^/10

upx trojan backdoor metasploit

Malware Config

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2472 created 3960	2472	WerFault.exe	71

ServiceHost packer 10 IoCs

Detects ServiceHost packer used for .NET malware

resource	yara_rule
behavioral2/memory/3960-6-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3960-7-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3960-9-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3960-8-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3960-10-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3960-11-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3960-12-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3960-13-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3960-14-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3960-15-0x0000000000000000-mapping.dmp	servicehost

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2472-19-0x0000016BF1330000-0x0000016BF1331000-memory.dmp	upx
behavioral2/memory/2472-19-0x0000016BF1330000-0x0000016BF1331000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
3960	ceba09dc5368ded2d7d5b62bd36fdecbd47aee8f3219abfd2ca32f31b0eba7b0.exe
3960	ceba09dc5368ded2d7d5b62bd36fdecbd47aee8f3219abfd2ca32f31b0eba7b0.exe

JavaScript code in executable 2 IoCs

resource	yara_rule
behavioral2/files/0x000100000001adbb-2.dat	js
behavioral2/files/0x000100000001adbb-1.dat	js

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2472	3960	WerFault.exe	71

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = fda653a2da85d601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = dfda3aa5da85d601	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2472	WerFault.exe
2472	WerFault.exe
2472	WerFault.exe
2472	WerFault.exe
2472	WerFault.exe
2472	WerFault.exe
2472	WerFault.exe
2472	WerFault.exe
2472	WerFault.exe
2472	WerFault.exe
2472	WerFault.exe
2472	WerFault.exe
2472	WerFault.exe
2472	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3980	svchost.exe
Token: SeCreatePagefilePrivilege	3980	svchost.exe
Token: SeDebugPrivilege	2472	WerFault.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3836 wrote to memory of 3960	3836	ceba09dc5368ded2d7d5b62bd36fdecbd47aee8f3219abfd2ca32f31b0eba7b0.exe	71
PID 3836 wrote to memory of 3960	3836	ceba09dc5368ded2d7d5b62bd36fdecbd47aee8f3219abfd2ca32f31b0eba7b0.exe	71

C:\Users\Admin\AppData\Local\Temp\ceba09dc5368ded2d7d5b62bd36fdecbd47aee8f3219abfd2ca32f31b0eba7b0.exe
"C:\Users\Admin\AppData\Local\Temp\ceba09dc5368ded2d7d5b62bd36fdecbd47aee8f3219abfd2ca32f31b0eba7b0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Users\Admin\AppData\Local\Temp\ceba09dc5368ded2d7d5b62bd36fdecbd47aee8f3219abfd2ca32f31b0eba7b0.exe
  "C:\Users\Admin\AppData\Local\Temp\ceba09dc5368ded2d7d5b62bd36fdecbd47aee8f3219abfd2ca32f31b0eba7b0.exe"
  2⤵
  - Loads dropped DLL
  PID:3960
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 3960 -s 1020
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2472-16-0x0000016BF1330000-0x0000016BF1331000-memory.dmp

Download

memory/2472-5-0x0000016BF08C0000-0x0000016BF08C1000-memory.dmp

Download

memory/2472-19-0x0000016BF1330000-0x0000016BF1331000-memory.dmp

Download

memory/2472-17-0x0000016BF1330000-0x0000016BF1331000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads