metasploit | 14bdf9b3bcb10c51b8dc10275ced93259dbf62ce31331ab3ccf6e5317d7a3cf5

General

Target

SecuriteInfo.com.BackDoor.Meterpreter.166.30487.16509.exe
Size

303KB
MD5

48073731d6bc08d6edba5cd9e157729a
SHA1

1f45b9d7573d182449935c1d39bde1fb11c7e3bc
SHA256

14bdf9b3bcb10c51b8dc10275ced93259dbf62ce31331ab3ccf6e5317d7a3cf5
SHA512

abbc4b43d620d2c36754509f82fa20b907a1c8018eed48093c1c4897d01248f1f8d6b1e7578f686c5deb12c62d7b89839b9d34f8be4bd869ff4066b42e6f49d2

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://778899aabb.ml:443/Yj2h

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 768 created 736 768 WerFault.exe calc.exe
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

SecuriteInfo.com.BackDoor.Meterpreter.166.30487.16509.exe

description pid process target process

PID 740 created 3016 740 SecuriteInfo.com.BackDoor.Meterpreter.166.30487.16509.exe Explorer.EXE
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

768 736 WerFault.exe calc.exe

description	pid	process	target process
PID 768 created 736	768	WerFault.exe	calc.exe

description	pid	process	target process
PID 740 created 3016	740	SecuriteInfo.com.BackDoor.Meterpreter.166.30487.16509.exe	Explorer.EXE

pid	pid_target	process	target process
768	736	WerFault.exe	calc.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

SecuriteInfo.com.BackDoor.Meterpreter.166.30487.16509.exeWerFault.exe

pid	process
740	SecuriteInfo.com.BackDoor.Meterpreter.166.30487.16509.exe
740	SecuriteInfo.com.BackDoor.Meterpreter.166.30487.16509.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 768 WerFault.exe

description	pid	process
Token: SeDebugPrivilege	768	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

SecuriteInfo.com.BackDoor.Meterpreter.166.30487.16509.exe

description	pid	process	target process
PID 740 wrote to memory of 736	740	SecuriteInfo.com.BackDoor.Meterpreter.166.30487.16509.exe	calc.exe
PID 740 wrote to memory of 736	740	SecuriteInfo.com.BackDoor.Meterpreter.166.30487.16509.exe	calc.exe
PID 740 wrote to memory of 736	740	SecuriteInfo.com.BackDoor.Meterpreter.166.30487.16509.exe	calc.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3016

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.Meterpreter.166.30487.16509.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.Meterpreter.166.30487.16509.exe"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:740

C:\Windows\System32\calc.exe
"C:\Windows\System32\calc.exe"
2⤵
PID:736

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 736 -s 1132
3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/736-4-0x0000000000000000-mapping.dmp

Download
memory/736-3-0x0000000000000000-mapping.dmp

Download
memory/736-6-0x0000000000000000-mapping.dmp

Download
memory/736-5-0x0000000000000000-mapping.dmp

Download
memory/736-7-0x0000000000000000-mapping.dmp

Download
memory/736-8-0x0000000000000000-mapping.dmp

Download
memory/736-9-0x0000000000000000-mapping.dmp

Download
memory/736-10-0x0000000000000000-mapping.dmp

Download
memory/736-11-0x0000000000000000-mapping.dmp

Download
memory/768-2-0x0000020C63020000-0x0000020C63021000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing