metasploit | 0271d754dcca50dbd6fc635b3bc62cff481e413e7f7e3b2d65d8adfe9ba331ea

General

Target

0271d754dcca50dbd6fc635b3bc62cff481e413e7f7e3b2d65d8adfe9ba331ea.exe
Size

1.7MB
MD5

e248655f3697df3fdce96ad5e2af3520
SHA1

193dcd419cb4ac481f29525c854ba8729d87426d
SHA256

0271d754dcca50dbd6fc635b3bc62cff481e413e7f7e3b2d65d8adfe9ba331ea
SHA512

dcbec146716196a86168407bbb9b3258daea0d71e517dbb99891f6a47f1af8dc74d1e674c038109f26ffeba576572b2a5cd6dd822dd5e5ac24f19f08705e6ed7

Score

10^/10

metasploit backdoor trojan upx

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

45.76.96.233:80

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/836-54-0x0000000000400000-0x0000000000811000-memory.dmp	upx
behavioral1/memory/836-58-0x0000000000400000-0x0000000000811000-memory.dmp	upx

Drops file in System32 directory 4 IoCs

Processes:

0271d754dcca50dbd6fc635b3bc62cff481e413e7f7e3b2d65d8adfe9ba331ea.exe

description	ioc	process
File created	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	0271d754dcca50dbd6fc635b3bc62cff481e413e7f7e3b2d65d8adfe9ba331ea.exe
File created	C:\Windows\SysWOW64\GroupPolicy\Machine\Scripts\scripts.ini	0271d754dcca50dbd6fc635b3bc62cff481e413e7f7e3b2d65d8adfe9ba331ea.exe
File created	C:\Windows\SysWOW64\GroupPolicy\Machine\Scripts\Startup\update.exe	0271d754dcca50dbd6fc635b3bc62cff481e413e7f7e3b2d65d8adfe9ba331ea.exe
File created	C:\Windows\SysWOW64\update.exe	0271d754dcca50dbd6fc635b3bc62cff481e413e7f7e3b2d65d8adfe9ba331ea.exe

Drops file in Windows directory 1 IoCs

Processes:

0271d754dcca50dbd6fc635b3bc62cff481e413e7f7e3b2d65d8adfe9ba331ea.exe

description ioc process

File created C:\Windows\WBEM\msupdate.mof 0271d754dcca50dbd6fc635b3bc62cff481e413e7f7e3b2d65d8adfe9ba331ea.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

mofcomp.exewhoami.exe

description pid process

Token: SeSecurityPrivilege 1400 mofcomp.exe
Token: SeDebugPrivilege 1216 whoami.exe

description	ioc	process
File created	C:\Windows\WBEM\msupdate.mof	0271d754dcca50dbd6fc635b3bc62cff481e413e7f7e3b2d65d8adfe9ba331ea.exe

description	pid	process
Token: SeSecurityPrivilege	1400	mofcomp.exe
Token: SeDebugPrivilege	1216	whoami.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

0271d754dcca50dbd6fc635b3bc62cff481e413e7f7e3b2d65d8adfe9ba331ea.execmd.execmd.exe

description	pid	process	target process
PID 836 wrote to memory of 1788	836	0271d754dcca50dbd6fc635b3bc62cff481e413e7f7e3b2d65d8adfe9ba331ea.exe	cmd.exe
PID 836 wrote to memory of 1788	836	0271d754dcca50dbd6fc635b3bc62cff481e413e7f7e3b2d65d8adfe9ba331ea.exe	cmd.exe
PID 836 wrote to memory of 1788	836	0271d754dcca50dbd6fc635b3bc62cff481e413e7f7e3b2d65d8adfe9ba331ea.exe	cmd.exe
PID 836 wrote to memory of 1788	836	0271d754dcca50dbd6fc635b3bc62cff481e413e7f7e3b2d65d8adfe9ba331ea.exe	cmd.exe
PID 1788 wrote to memory of 1400	1788	cmd.exe	mofcomp.exe
PID 1788 wrote to memory of 1400	1788	cmd.exe	mofcomp.exe
PID 1788 wrote to memory of 1400	1788	cmd.exe	mofcomp.exe
PID 1788 wrote to memory of 1400	1788	cmd.exe	mofcomp.exe
PID 836 wrote to memory of 1516	836	0271d754dcca50dbd6fc635b3bc62cff481e413e7f7e3b2d65d8adfe9ba331ea.exe	cmd.exe
PID 836 wrote to memory of 1516	836	0271d754dcca50dbd6fc635b3bc62cff481e413e7f7e3b2d65d8adfe9ba331ea.exe	cmd.exe
PID 836 wrote to memory of 1516	836	0271d754dcca50dbd6fc635b3bc62cff481e413e7f7e3b2d65d8adfe9ba331ea.exe	cmd.exe
PID 836 wrote to memory of 1516	836	0271d754dcca50dbd6fc635b3bc62cff481e413e7f7e3b2d65d8adfe9ba331ea.exe	cmd.exe
PID 1516 wrote to memory of 1216	1516	cmd.exe	whoami.exe
PID 1516 wrote to memory of 1216	1516	cmd.exe	whoami.exe
PID 1516 wrote to memory of 1216	1516	cmd.exe	whoami.exe
PID 1516 wrote to memory of 1216	1516	cmd.exe	whoami.exe

C:\Users\Admin\AppData\Local\Temp\0271d754dcca50dbd6fc635b3bc62cff481e413e7f7e3b2d65d8adfe9ba331ea.exe
"C:\Users\Admin\AppData\Local\Temp\0271d754dcca50dbd6fc635b3bc62cff481e413e7f7e3b2d65d8adfe9ba331ea.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:836

C:\Windows\SysWOW64\cmd.exe
cmd /c "mofcomp C:\Windows\WBEM\msupdate.mof"
2⤵
- Suspicious use of WriteProcessMemory
PID:1788

C:\Windows\SysWOW64\Wbem\mofcomp.exe
mofcomp C:\Windows\WBEM\msupdate.mof
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1400

C:\Windows\SysWOW64\cmd.exe
cmd /c whoami
2⤵
- Suspicious use of WriteProcessMemory
PID:1516

C:\Windows\SysWOW64\whoami.exe
whoami
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1216

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\WBEM\msupdate.mof
Filesize
660B

MD5
b70ae3f71fade0488b8b0f3779179dcb

SHA1
bf54be0517821042c9137925e411f5522be7f7f9

SHA256
459304c4f49ea4b4bc798bb9cc9b1722fa1ffe47ac887e8d2666fddfcdb6030c

SHA512
f851d870e0d9d8639ca76e4eac3638f9bd1050186c1708583751eaefcaa6777e5eae8163b5c7fb2eb46944e365bdfc1e0abfbc9ab98858131b126e1488900ad6

Download Submit
memory/836-54-0x0000000000400000-0x0000000000811000-memory.dmp

Filesize
4.1MB

Download
memory/836-58-0x0000000000400000-0x0000000000811000-memory.dmp

Filesize
4.1MB

Download
memory/1216-60-0x0000000000000000-mapping.dmp

Download
memory/1400-56-0x0000000000000000-mapping.dmp

Download
memory/1516-59-0x0000000000000000-mapping.dmp

Download
memory/1788-55-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads