Overview

overview

10

Static

static

1127d36455...48.exe

windows7_x64

10

1127d36455...48.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1127d36455c5db612941bf6460ec52053d0c4348b125914540b5900992ebed48

  • Size

    577KB

  • Sample

    220604-knas3sbghr

  • MD5

    08968264009fc1b172e66c0e7e0b5331

  • SHA1

    15eb75544e41e7894dd263651167af9b63bc2632

  • SHA256

    1127d36455c5db612941bf6460ec52053d0c4348b125914540b5900992ebed48

  • SHA512

    18f6231f56da3aa63120c5005760f7be18f47e61ecbfaf37c27242b12b91461b55d0e1e992050baf80035fcd8482f742c25eff42b580d1a74a2668b2e9b157a3

Score
10/10
metasploitbackdoorevasiontrojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

    • Target

      1127d36455c5db612941bf6460ec52053d0c4348b125914540b5900992ebed48

    • Size

      577KB

    • MD5

      08968264009fc1b172e66c0e7e0b5331

    • SHA1

      15eb75544e41e7894dd263651167af9b63bc2632

    • SHA256

      1127d36455c5db612941bf6460ec52053d0c4348b125914540b5900992ebed48

    • SHA512

      18f6231f56da3aa63120c5005760f7be18f47e61ecbfaf37c27242b12b91461b55d0e1e992050baf80035fcd8482f742c25eff42b580d1a74a2668b2e9b157a3

    Score
    10/10
    metasploitbackdoorevasiontrojan

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

1
T1012

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks