metasploit | 13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071

General

Target

13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe
Size

84KB
MD5

d29a4f42b14963a79065bd7055799eb4
SHA1

8d95394fba3164440e1627f02a0963167e154521
SHA256

13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071
SHA512

6cfc6a7db13c2224804c5ca32abdf541726859e36b873adfb22adff9506920bd42916ed52340dc9dd26d0cae4d9d2cf721eb9b7121d97e1ec38b226b4923d003

Score

10^/10

metasploit backdoor persistence trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft Config Setup = "C:\\Windows\\jodrive32.exe"	13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe

Executes dropped EXE 2 IoCs

Processes:

jodrive32.exejodrive32.exe

pid process

1776 jodrive32.exe
1204 jodrive32.exe

pid	process
1776	jodrive32.exe
1204	jodrive32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Config Setup = "C:\\Windows\\jodrive32.exe"	13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exejodrive32.exe

description	pid	process	target process
PID 916 set thread context of 2028	916	13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe	13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe
PID 1776 set thread context of 1204	1776	jodrive32.exe	jodrive32.exe

Drops file in Windows directory 3 IoCs

Processes:

13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exejodrive32.exe

description	ioc	process
File created	C:\Windows\jodrive32.exe	13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe
File opened for modification	C:\Windows\jodrive32.exe	13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe
File created	C:\Windows\%windir%\eilfiie32.log	jodrive32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe

pid	process
2028	13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe
2028	13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exejodrive32.exe

description	pid	process	target process
PID 916 wrote to memory of 2028	916	13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe	13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe
PID 916 wrote to memory of 2028	916	13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe	13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe
PID 916 wrote to memory of 2028	916	13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe	13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe
PID 916 wrote to memory of 2028	916	13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe	13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe
PID 916 wrote to memory of 2028	916	13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe	13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe
PID 916 wrote to memory of 2028	916	13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe	13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe
PID 916 wrote to memory of 2028	916	13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe	13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe
PID 916 wrote to memory of 2028	916	13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe	13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe
PID 2028 wrote to memory of 1776	2028	13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe	jodrive32.exe
PID 2028 wrote to memory of 1776	2028	13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe	jodrive32.exe
PID 2028 wrote to memory of 1776	2028	13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe	jodrive32.exe
PID 2028 wrote to memory of 1776	2028	13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe	jodrive32.exe
PID 1776 wrote to memory of 1204	1776	jodrive32.exe	jodrive32.exe
PID 1776 wrote to memory of 1204	1776	jodrive32.exe	jodrive32.exe
PID 1776 wrote to memory of 1204	1776	jodrive32.exe	jodrive32.exe
PID 1776 wrote to memory of 1204	1776	jodrive32.exe	jodrive32.exe
PID 1776 wrote to memory of 1204	1776	jodrive32.exe	jodrive32.exe
PID 1776 wrote to memory of 1204	1776	jodrive32.exe	jodrive32.exe
PID 1776 wrote to memory of 1204	1776	jodrive32.exe	jodrive32.exe
PID 1776 wrote to memory of 1204	1776	jodrive32.exe	jodrive32.exe

C:\Users\Admin\AppData\Local\Temp\13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe
"C:\Users\Admin\AppData\Local\Temp\13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:916

C:\Users\Admin\AppData\Local\Temp\13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe
C:\Users\Admin\AppData\Local\Temp\13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071.exe
2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\jodrive32.exe
"C:\Windows\jodrive32.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1776

C:\Windows\jodrive32.exe
C:\Windows\jodrive32.exe
4⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1204

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\jodrive32.exe
Filesize
84KB

MD5
d29a4f42b14963a79065bd7055799eb4

SHA1
8d95394fba3164440e1627f02a0963167e154521

SHA256
13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071

SHA512
6cfc6a7db13c2224804c5ca32abdf541726859e36b873adfb22adff9506920bd42916ed52340dc9dd26d0cae4d9d2cf721eb9b7121d97e1ec38b226b4923d003

Download Submit
C:\Windows\jodrive32.exe
Filesize
84KB

MD5
d29a4f42b14963a79065bd7055799eb4

SHA1
8d95394fba3164440e1627f02a0963167e154521

SHA256
13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071

SHA512
6cfc6a7db13c2224804c5ca32abdf541726859e36b873adfb22adff9506920bd42916ed52340dc9dd26d0cae4d9d2cf721eb9b7121d97e1ec38b226b4923d003

Download Submit
C:\Windows\jodrive32.exe
Filesize
84KB

MD5
d29a4f42b14963a79065bd7055799eb4

SHA1
8d95394fba3164440e1627f02a0963167e154521

SHA256
13cdb8e810332bcaa0067d3c234e34e11979208ccebb1f8cffb9d9faefd33071

SHA512
6cfc6a7db13c2224804c5ca32abdf541726859e36b873adfb22adff9506920bd42916ed52340dc9dd26d0cae4d9d2cf721eb9b7121d97e1ec38b226b4923d003

Download Submit
memory/1204-115-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1204-114-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1204-108-0x0000000000407650-mapping.dmp

Download
memory/1776-82-0x0000000000000000-mapping.dmp

Download
memory/2028-76-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2028-81-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2028-80-0x00000000753B1000-0x00000000753B3000-memory.dmp

Filesize
8KB

Download
memory/2028-79-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2028-77-0x0000000000407650-mapping.dmp

Download
memory/2028-70-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2028-74-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2028-113-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2028-73-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2028-71-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads