metasploit | 5f3916cde8f3852fc370be7442e668f31a0d676f2ae912f88042481f972cc26a

General

Target

23s.exe
Size

71KB
MD5

e79d48bc650a2e1bd36d73f438826b8d
SHA1

191e1644ca6b40fd8469d8013e4f931ac9877c18
SHA256

5f3916cde8f3852fc370be7442e668f31a0d676f2ae912f88042481f972cc26a
SHA512

7451442c8ff56ce0124efe429afbba480c71e56247f5cbebe83a0aa7107e9e3c3f68e891dfa928d1fc47be8c5fd715f59ebd252cf4d3d06f1eb471f6d422948d

Score

10^/10

metasploit mimikatz backdoor suricata trojan

Malware Config

Extracted

Family

metasploit

Version

metasploit_stager

C2

51.75.89.111:50438

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
suricata: ET MALWARE Possible Metasploit Payload Common Construct Bind_API (from server)
suricata: ET MALWARE Possible Metasploit Payload Common Construct Bind_API (from server)
suricata

mimikatz is an open source tool to dump credentials on Windows 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1900-62-0x00000000029A0000-0x0000000002B0A000-memory.dmp	mimikatz
behavioral1/memory/1900-64-0x0000000002B10000-0x0000000002C7E000-memory.dmp	mimikatz
behavioral1/memory/1900-79-0x0000000002B10000-0x0000000002C7E000-memory.dmp	mimikatz

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

svchost.exe

pid process

1900 svchost.exe
1900 svchost.exe
1900 svchost.exe
1900 svchost.exe
1900 svchost.exe
1900 svchost.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

svchost.exe

description pid process

Token: SeDebugPrivilege 1900 svchost.exe
Token: SeDebugPrivilege 1900 svchost.exe

pid	process
1900	svchost.exe
1900	svchost.exe
1900	svchost.exe
1900	svchost.exe
1900	svchost.exe
1900	svchost.exe

description	pid	process
Token: SeDebugPrivilege	1900	svchost.exe
Token: SeDebugPrivilege	1900	svchost.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

23s.exesvchost.exe

description	pid	process	target process
PID 1684 wrote to memory of 1900	1684	23s.exe	svchost.exe
PID 1684 wrote to memory of 1900	1684	23s.exe	svchost.exe
PID 1684 wrote to memory of 1900	1684	23s.exe	svchost.exe
PID 1684 wrote to memory of 1900	1684	23s.exe	svchost.exe
PID 1900 wrote to memory of 1908	1900	svchost.exe	notepad.exe
PID 1900 wrote to memory of 1908	1900	svchost.exe	notepad.exe
PID 1900 wrote to memory of 1908	1900	svchost.exe	notepad.exe
PID 1900 wrote to memory of 1908	1900	svchost.exe	notepad.exe
PID 1900 wrote to memory of 1908	1900	svchost.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\23s.exe
"C:\Users\Admin\AppData\Local\Temp\23s.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\system32\svchost.exe
svchost.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900

C:\Windows\system32\notepad.exe
notepad.exe
3⤵
PID:1908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1900-61-0x0000000000130000-0x0000000000157000-memory.dmp

Filesize
156KB

Download
memory/1900-63-0x0000000000640000-0x000000000067B000-memory.dmp

Filesize
236KB

Download
memory/1900-56-0x0000000000640000-0x000000000067B000-memory.dmp

Filesize
236KB

Download
memory/1900-58-0x00000000020F0000-0x00000000021F0000-memory.dmp

Filesize
1024KB

Download
memory/1900-59-0x00000000021F0000-0x000000000224F000-memory.dmp

Filesize
380KB

Download
memory/1900-60-0x0000000000407000-0x0000000000428000-memory.dmp

Filesize
132KB

Download
memory/1900-55-0x0000000000350000-0x0000000000385000-memory.dmp

Filesize
212KB

Download
memory/1900-62-0x00000000029A0000-0x0000000002B0A000-memory.dmp

Filesize
1.4MB

Download
memory/1900-75-0x0000000000407000-0x0000000000428000-memory.dmp

Filesize
132KB

Download
memory/1900-64-0x0000000002B10000-0x0000000002C7E000-memory.dmp

Filesize
1.4MB

Download
memory/1900-54-0x0000000000000000-mapping.dmp

Download
memory/1900-79-0x0000000002B10000-0x0000000002C7E000-memory.dmp

Filesize
1.4MB

Download
memory/1900-78-0x00000000029A0000-0x0000000002B0A000-memory.dmp

Filesize
1.4MB

Download
memory/1900-68-0x00000000020F0000-0x00000000021F0000-memory.dmp

Filesize
1024KB

Download
memory/1900-69-0x00000000021F0000-0x000000000224F000-memory.dmp

Filesize
380KB

Download
memory/1908-65-0x0000000000000000-mapping.dmp

Download
memory/1908-76-0x0000000000110000-0x0000000000131000-memory.dmp

Filesize
132KB

Download
memory/1908-72-0x0000000002AB0000-0x0000000002B2D000-memory.dmp

Filesize
500KB

Download
memory/1908-77-0x0000000000140000-0x0000000000166000-memory.dmp

Filesize
152KB

Download
memory/1908-67-0x0000000000110000-0x0000000000131000-memory.dmp

Filesize
132KB

Download
memory/1908-66-0x000007FEFC021000-0x000007FEFC023000-memory.dmp

Filesize
8KB

Download
memory/1908-80-0x0000000000140000-0x0000000000166000-memory.dmp

Filesize
152KB

Download

Analysis

Sharing