metasploit | 34a542356ac8a3f6e367c6827b728e18e905c71574b3813f163e043f70aa3bfa

General

Target

34a542356ac8a3f6e367c6827b728e18e905c71574b3813f163e043f70aa3bfa.exe
Size

120KB
MD5

0d0320878946a73749111e6c94bf1525
SHA1

1e9b5c685640df11659aea7748d9bf3df70aadcf
SHA256

34a542356ac8a3f6e367c6827b728e18e905c71574b3813f163e043f70aa3bfa
SHA512

fc695dd905213d7b623d33d2fa9302399897970f3b8705182fa50e771dad13dac5d5d302a508cdc4f3fdb37122999f2d492188667b92050fe49a29abff53a8b1

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Executes dropped EXE 3 IoCs

Processes:

thinprobe.exethinprobe.exethinprobe.exe

pid process

3460 thinprobe.exe
1340 thinprobe.exe
3956 thinprobe.exe
Deletes itself 1 IoCs

Processes:

thinprobe.exe

pid process

3460 thinprobe.exe
Loads dropped DLL 1 IoCs

Processes:

thinprobe.exe

pid process

3460 thinprobe.exe
Drops file in Windows directory 1 IoCs

Processes:

thinprobe.exe

description ioc process

File opened for modification C:\Windows\pcawhere\config.ini thinprobe.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies data under HKEY_USERS 1 IoCs

Processes:

svchost.exe

description ioc process

Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe

pid	process
3460	thinprobe.exe
1340	thinprobe.exe
3956	thinprobe.exe

pid	process
3460	thinprobe.exe

pid	process
3460	thinprobe.exe

description	ioc	process
File opened for modification	C:\Windows\pcawhere\config.ini	thinprobe.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

svchost.exe

pid	process
4060	svchost.exe
4060	svchost.exe
4060	svchost.exe
4060	svchost.exe
4060	svchost.exe
4060	svchost.exe
4060	svchost.exe
4060	svchost.exe
4060	svchost.exe
4060	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

thinprobe.exethinprobe.exe

description pid process

Token: SeDebugPrivilege 3460 thinprobe.exe
Token: SeDebugPrivilege 3956 thinprobe.exe

description	pid	process
Token: SeDebugPrivilege	3460	thinprobe.exe
Token: SeDebugPrivilege	3956	thinprobe.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

34a542356ac8a3f6e367c6827b728e18e905c71574b3813f163e043f70aa3bfa.exethinprobe.exethinprobe.exe

description	pid	process	target process
PID 2664 wrote to memory of 3460	2664	34a542356ac8a3f6e367c6827b728e18e905c71574b3813f163e043f70aa3bfa.exe	thinprobe.exe
PID 2664 wrote to memory of 3460	2664	34a542356ac8a3f6e367c6827b728e18e905c71574b3813f163e043f70aa3bfa.exe	thinprobe.exe
PID 2664 wrote to memory of 3460	2664	34a542356ac8a3f6e367c6827b728e18e905c71574b3813f163e043f70aa3bfa.exe	thinprobe.exe
PID 3460 wrote to memory of 1340	3460	thinprobe.exe	thinprobe.exe
PID 3460 wrote to memory of 1340	3460	thinprobe.exe	thinprobe.exe
PID 3460 wrote to memory of 1340	3460	thinprobe.exe	thinprobe.exe
PID 3956 wrote to memory of 4060	3956	thinprobe.exe	svchost.exe
PID 3956 wrote to memory of 4060	3956	thinprobe.exe	svchost.exe
PID 3956 wrote to memory of 4060	3956	thinprobe.exe	svchost.exe
PID 3956 wrote to memory of 4060	3956	thinprobe.exe	svchost.exe
PID 3956 wrote to memory of 4060	3956	thinprobe.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\34a542356ac8a3f6e367c6827b728e18e905c71574b3813f163e043f70aa3bfa.exe
"C:\Users\Admin\AppData\Local\Temp\34a542356ac8a3f6e367c6827b728e18e905c71574b3813f163e043f70aa3bfa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2664

C:\Users\Admin\AppData\Local\Temp\7z5EC32A68\thinprobe.exe
C:\Users\Admin\AppData\Local\Temp\7z5EC32A68\thinprobe.exe
2⤵
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3460

C:\Windows\pcawhere\thinprobe.exe
"C:\Windows\pcawhere\thinprobe.exe"
3⤵
- Executes dropped EXE
PID:1340

C:\Windows\pcawhere\thinprobe.exe
C:\Windows\pcawhere\thinprobe.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3956

C:\Windows\SysWOW64\svchost.exe
-daemon
2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4060

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7z5EC32A68\ThinHostProbedll.dll
MD5
bfb71e0efe5d9208aa9cbdfd4a85a52d

SHA1
ea487fbad911df1f51aa9332336847e2d5dd68bf

SHA256
c195afb7048664ea2a68fa11b5ebeca502ee5454b2364216d0002a3bfda7057d

SHA512
de7490b47939de9e634bea75400c0d820e4e62ee083020e18a48b66fff8ad307926778424fe315ca616878361babe6e6642272ce1eb9036b661c37cd5960bdf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z5EC32A68\thinprobe.exe
MD5
65e6e6fffa769830d76ac4fae2433121

SHA1
ced1d78304c4b4dfeb357739859587744e7530da

SHA256
76d2e897ca235beab44ee7eaab9ede7bc7868bbaeb7d6cb10b4323c07eb216af

SHA512
8303a755fc5e4f7a3de9f6efde12243a75f90532384c002b5168ec88cd60b34b6024accdf916a91d625ca07bfdb07364c971b482c2ebb9c9a84c10409526808a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z5EC32A68\thinprobe.exe
MD5
65e6e6fffa769830d76ac4fae2433121

SHA1
ced1d78304c4b4dfeb357739859587744e7530da

SHA256
76d2e897ca235beab44ee7eaab9ede7bc7868bbaeb7d6cb10b4323c07eb216af

SHA512
8303a755fc5e4f7a3de9f6efde12243a75f90532384c002b5168ec88cd60b34b6024accdf916a91d625ca07bfdb07364c971b482c2ebb9c9a84c10409526808a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z5EC32A68\thumb.db
MD5
fe185cb4315658e561fd789181dfd1f3

SHA1
dc6468dd9ab1c73210990c55cca82111ed21e00d

SHA256
eb9f6f3fb6b70d1f49c1c92442a0f96e7583e757b035cb4343767cf9382eb354

SHA512
88347235e77553c976d5d45278d8d51d15815523fc57be73d21b6676ea9f296d16d6c96b6f81f1e3900c373717c589fa3c510ef8f6e33df72ea32ef036687382

Download Submit
C:\Windows\pcawhere\config.ini
MD5
c088a60d0ef4dc2a42e17e7e6b8762a6

SHA1
9544a6b2a5262d1bddf3574baad5a86160a3de94

SHA256
5bb28082c50017f6d5bfbf7e8cc8886c5bbeba6063ebda0ba92d0a675636bf53

SHA512
46472bb6bcd63d1b149fe373e2026fe61cd02a6dfded04bf7f2548b88557582ed2d8c2ea4c2e591d74f2d373e12197488a30fd3ff690cc4bddc91c4b81a1ff90

Download Submit
C:\Windows\pcawhere\thinprobe.exe
MD5
65e6e6fffa769830d76ac4fae2433121

SHA1
ced1d78304c4b4dfeb357739859587744e7530da

SHA256
76d2e897ca235beab44ee7eaab9ede7bc7868bbaeb7d6cb10b4323c07eb216af

SHA512
8303a755fc5e4f7a3de9f6efde12243a75f90532384c002b5168ec88cd60b34b6024accdf916a91d625ca07bfdb07364c971b482c2ebb9c9a84c10409526808a

Download Submit
C:\Windows\pcawhere\thinprobe.exe
MD5
65e6e6fffa769830d76ac4fae2433121

SHA1
ced1d78304c4b4dfeb357739859587744e7530da

SHA256
76d2e897ca235beab44ee7eaab9ede7bc7868bbaeb7d6cb10b4323c07eb216af

SHA512
8303a755fc5e4f7a3de9f6efde12243a75f90532384c002b5168ec88cd60b34b6024accdf916a91d625ca07bfdb07364c971b482c2ebb9c9a84c10409526808a

Download Submit
\Users\Admin\AppData\Local\Temp\7z5EC32A68\thinhostprobedll.dll
MD5
bfb71e0efe5d9208aa9cbdfd4a85a52d

SHA1
ea487fbad911df1f51aa9332336847e2d5dd68bf

SHA256
c195afb7048664ea2a68fa11b5ebeca502ee5454b2364216d0002a3bfda7057d

SHA512
de7490b47939de9e634bea75400c0d820e4e62ee083020e18a48b66fff8ad307926778424fe315ca616878361babe6e6642272ce1eb9036b661c37cd5960bdf6

Download Submit
memory/1340-141-0x0000000073FB0000-0x0000000073FBD000-memory.dmp

Filesize
52KB

Download
memory/3460-127-0x0000000073FB0000-0x0000000073FBD000-memory.dmp

Filesize
52KB

Download
memory/3460-123-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/3956-139-0x0000000073FB0000-0x0000000073FBD000-memory.dmp

Filesize
52KB

Download
memory/3956-140-0x00000000001E0000-0x00000000001ED000-memory.dmp

Filesize
52KB

Download
memory/4060-142-0x0000000002840000-0x000000000284D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing