metasploit | 191bd1fa383ec90337de27de9212572e710b44944cb67c3c923852a16c3783db

General

Target

evil.hta
Size

28KB
MD5

05fd981b5e82d5060701f064abb4e42d
SHA1

5073ea76853a70b2332096bbc800525025a2e527
SHA256

191bd1fa383ec90337de27de9212572e710b44944cb67c3c923852a16c3783db
SHA512

f8e28526beca600c8d0d625f7a716a4ffe663b9c48d2016c33e94257bbc312c09c40ccc5c1055d433330607a96d35f25a8ced1f2d1e62344abf3ba49feb89328

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://45.138.172.81:443/m6Ip

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Executes dropped EXE 1 IoCs

Processes:

evil.exe

pid process

1988 evil.exe
Loads dropped DLL 2 IoCs

Processes:

mshta.exe

pid process

1744 mshta.exe
1744 mshta.exe
Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

mshta.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main mshta.exe

pid	process
1988	evil.exe

pid	process
1744	mshta.exe
1744	mshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

mshta.exe

description	pid	process	target process
PID 1744 wrote to memory of 1988	1744	mshta.exe	evil.exe
PID 1744 wrote to memory of 1988	1744	mshta.exe	evil.exe
PID 1744 wrote to memory of 1988	1744	mshta.exe	evil.exe
PID 1744 wrote to memory of 1988	1744	mshta.exe	evil.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\evil.hta"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1744

C:\Users\Admin\AppData\Local\Temp\radD7415.tmp\evil.exe
"C:\Users\Admin\AppData\Local\Temp\radD7415.tmp\evil.exe"
2⤵
- Executes dropped EXE
PID:1988

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\radD7415.tmp\evil.exe
MD5
632c473082cd11293a641a95155dd28d

SHA1
25f20fd04db1e53dbd8329d18b1d6e4606863dca

SHA256
af5903de7fbd2df77be4213ad29524e9066600172ecf335a98148c48734da5c2

SHA512
4a780e7ee1f58594bed535ad4e36c21be027b07f0f404c30e5a2b97caa7102cfe93792b25db58f5ad7e95f3192d1f8fe5903099f087314fe0b9577af2cbf1d74

Download Submit
\Users\Admin\AppData\Local\Temp\radD7415.tmp\evil.exe
MD5
632c473082cd11293a641a95155dd28d

SHA1
25f20fd04db1e53dbd8329d18b1d6e4606863dca

SHA256
af5903de7fbd2df77be4213ad29524e9066600172ecf335a98148c48734da5c2

SHA512
4a780e7ee1f58594bed535ad4e36c21be027b07f0f404c30e5a2b97caa7102cfe93792b25db58f5ad7e95f3192d1f8fe5903099f087314fe0b9577af2cbf1d74

Download Submit
\Users\Admin\AppData\Local\Temp\radD7415.tmp\evil.exe
MD5
632c473082cd11293a641a95155dd28d

SHA1
25f20fd04db1e53dbd8329d18b1d6e4606863dca

SHA256
af5903de7fbd2df77be4213ad29524e9066600172ecf335a98148c48734da5c2

SHA512
4a780e7ee1f58594bed535ad4e36c21be027b07f0f404c30e5a2b97caa7102cfe93792b25db58f5ad7e95f3192d1f8fe5903099f087314fe0b9577af2cbf1d74

Download Submit
memory/1064-5-0x000007FEF63D0000-0x000007FEF664A000-memory.dmp

Filesize
2.5MB

Download
memory/1744-11-0x00000000055C0000-0x00000000055E3000-memory.dmp

Filesize
140KB

Download
memory/1988-2-0x0000000000000000-mapping.dmp

Download
memory/1988-4-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing