metasploit | 255efe4670bbd6239d372d2fe68057d4a4f5fdf7a147e0ae0a694777b18cbe22

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20220414-en
submitted
11-06-2022 19:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

255efe4670bbd6239d372d2fe68057d4a4f5fdf7a147e0ae0a694777b18cbe22.exe
Size

43KB
MD5

e3fe697e069d3bcaca7c54add58a0325
SHA1

c45c937ae0dd3809742fe8cc618ea05fcf32a1c1
SHA256

255efe4670bbd6239d372d2fe68057d4a4f5fdf7a147e0ae0a694777b18cbe22
SHA512

5ccd44dd515351f2827fa513ebd3c97b7b879ef2682631dc163273ef1c2ddedd81085e33e04b56d73326a390cb44ada697cd90358782564c1e6998891f266289

Score

10^/10

metasploit backdoor trojan upx

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1964-55-0x0000000000400000-0x000000000041E000-memory.dmp	upx

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1960 cmd.exe

pid	process
1960	cmd.exe

Drops file in System32 directory 2 IoCs

Processes:

255efe4670bbd6239d372d2fe68057d4a4f5fdf7a147e0ae0a694777b18cbe22.exe

description	ioc	process
File created	C:\Windows\SysWOW64\dllcache\svchost.exe	255efe4670bbd6239d372d2fe68057d4a4f5fdf7a147e0ae0a694777b18cbe22.exe
File opened for modification	C:\Windows\SysWOW64\dllcache\svchost.exe	255efe4670bbd6239d372d2fe68057d4a4f5fdf7a147e0ae0a694777b18cbe22.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

255efe4670bbd6239d372d2fe68057d4a4f5fdf7a147e0ae0a694777b18cbe22.exe

description	pid	process	target process
PID 1964 wrote to memory of 1960	1964	255efe4670bbd6239d372d2fe68057d4a4f5fdf7a147e0ae0a694777b18cbe22.exe	cmd.exe
PID 1964 wrote to memory of 1960	1964	255efe4670bbd6239d372d2fe68057d4a4f5fdf7a147e0ae0a694777b18cbe22.exe	cmd.exe
PID 1964 wrote to memory of 1960	1964	255efe4670bbd6239d372d2fe68057d4a4f5fdf7a147e0ae0a694777b18cbe22.exe	cmd.exe
PID 1964 wrote to memory of 1960	1964	255efe4670bbd6239d372d2fe68057d4a4f5fdf7a147e0ae0a694777b18cbe22.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\255efe4670bbd6239d372d2fe68057d4a4f5fdf7a147e0ae0a694777b18cbe22.exe
"C:\Users\Admin\AppData\Local\Temp\255efe4670bbd6239d372d2fe68057d4a4f5fdf7a147e0ae0a694777b18cbe22.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\255EFE~1.EXE >> NUL
2⤵
- Deletes itself
PID:1960

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1960-56-0x0000000000000000-mapping.dmp

Download
memory/1964-54-0x0000000075401000-0x0000000075403000-memory.dmp

Filesize
8KB

Download
memory/1964-55-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads