metasploit | 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a

General

Target

3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe
Size

196KB
MD5

f9e95ae291c9d014bf6d7c035038c665
SHA1

2d5ce01b255c567489c218bd5cc72aa3a966fcd9
SHA256

3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a
SHA512

f44d95b5fa0295122ac894724a896db353c740169167031413bf76e469b26af02d7652e6a79aa0fb10097ca7fb4b4437277fcce08623453a3bbbe42999e72970

Score

10^/10

metasploit backdoor persistence suricata trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
suricata: ET MALWARE IRC Nick change on non-standard port
suricata: ET MALWARE IRC Nick change on non-standard port
suricata
suricata: ET MALWARE Likely Bot Nick in IRC (USA +..)
suricata: ET MALWARE Likely Bot Nick in IRC (USA +..)
suricata

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft Driver Setup = "C:\\Windows\\system32\\shmt.exe"	3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe

Executes dropped EXE 2 IoCs

Processes:

shmt.exeshmt.exe

pid process

4320 shmt.exe
4064 shmt.exe

pid	process
4320	shmt.exe
4064	shmt.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Driver Setup = "C:\\Windows\\system32\\shmt.exe"	3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe

Drops file in System32 directory 4 IoCs

Processes:

3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exeshmt.exe

description	ioc	process
File created	C:\Windows\SysWOW64\shmt.exe	3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe
File opened for modification	C:\Windows\SysWOW64\shmt.exe	3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe
File opened for modification	C:\Windows\SysWOW64\shmt.exe	shmt.exe
File created	C:\Windows\SysWOW64\shmt.exe	shmt.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exeshmt.exe

description	pid	process	target process
PID 4828 set thread context of 2612	4828	3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe	3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe
PID 4320 set thread context of 4064	4320	shmt.exe	shmt.exe

Drops file in Windows directory 1 IoCs

Processes:

shmt.exe

description ioc process

File created C:\Windows\logfile32.txt shmt.exe

description	ioc	process
File created	C:\Windows\logfile32.txt	shmt.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exeshmt.exe

pid	process
2612	3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe
2612	3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe
2612	3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe
2612	3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe
2612	3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe
2612	3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe
4064	shmt.exe
4064	shmt.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exeshmt.exe

description	pid	process
Token: SeDebugPrivilege	2612	3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe
Token: SeDebugPrivilege	4064	shmt.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exeshmt.exe

pid process

4828 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe
4320 shmt.exe

pid	process
4828	3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe
4320	shmt.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exeshmt.exe

description	pid	process	target process
PID 4828 wrote to memory of 2612	4828	3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe	3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe
PID 4828 wrote to memory of 2612	4828	3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe	3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe
PID 4828 wrote to memory of 2612	4828	3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe	3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe
PID 4828 wrote to memory of 2612	4828	3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe	3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe
PID 4828 wrote to memory of 2612	4828	3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe	3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe
PID 4828 wrote to memory of 2612	4828	3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe	3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe
PID 4828 wrote to memory of 2612	4828	3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe	3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe
PID 4828 wrote to memory of 2612	4828	3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe	3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe
PID 2612 wrote to memory of 4320	2612	3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe	shmt.exe
PID 2612 wrote to memory of 4320	2612	3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe	shmt.exe
PID 2612 wrote to memory of 4320	2612	3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe	shmt.exe
PID 4320 wrote to memory of 4064	4320	shmt.exe	shmt.exe
PID 4320 wrote to memory of 4064	4320	shmt.exe	shmt.exe
PID 4320 wrote to memory of 4064	4320	shmt.exe	shmt.exe
PID 4320 wrote to memory of 4064	4320	shmt.exe	shmt.exe
PID 4320 wrote to memory of 4064	4320	shmt.exe	shmt.exe
PID 4320 wrote to memory of 4064	4320	shmt.exe	shmt.exe
PID 4320 wrote to memory of 4064	4320	shmt.exe	shmt.exe
PID 4320 wrote to memory of 4064	4320	shmt.exe	shmt.exe

C:\Users\Admin\AppData\Local\Temp\3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe
"C:\Users\Admin\AppData\Local\Temp\3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4828

C:\Users\Admin\AppData\Local\Temp\3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe
"C:\Users\Admin\AppData\Local\Temp\3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe"
2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2612

C:\Windows\SysWOW64\shmt.exe
"C:\Windows\system32\shmt.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4320

C:\Windows\SysWOW64\shmt.exe
"C:\Windows\SysWOW64\shmt.exe"
4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4064

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\shmt.exe
Filesize
196KB

MD5
f9e95ae291c9d014bf6d7c035038c665

SHA1
2d5ce01b255c567489c218bd5cc72aa3a966fcd9

SHA256
3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a

SHA512
f44d95b5fa0295122ac894724a896db353c740169167031413bf76e469b26af02d7652e6a79aa0fb10097ca7fb4b4437277fcce08623453a3bbbe42999e72970

Download Submit
C:\Windows\SysWOW64\shmt.exe
Filesize
196KB

MD5
f9e95ae291c9d014bf6d7c035038c665

SHA1
2d5ce01b255c567489c218bd5cc72aa3a966fcd9

SHA256
3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a

SHA512
f44d95b5fa0295122ac894724a896db353c740169167031413bf76e469b26af02d7652e6a79aa0fb10097ca7fb4b4437277fcce08623453a3bbbe42999e72970

Download Submit
C:\Windows\SysWOW64\shmt.exe
Filesize
196KB

MD5
f9e95ae291c9d014bf6d7c035038c665

SHA1
2d5ce01b255c567489c218bd5cc72aa3a966fcd9

SHA256
3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a

SHA512
f44d95b5fa0295122ac894724a896db353c740169167031413bf76e469b26af02d7652e6a79aa0fb10097ca7fb4b4437277fcce08623453a3bbbe42999e72970

Download Submit
memory/2612-134-0x0000000000000000-mapping.dmp

Download
memory/2612-135-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2612-137-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2612-144-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4064-145-0x0000000000000000-mapping.dmp

Download
memory/4064-150-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4320-138-0x0000000000000000-mapping.dmp

Download
memory/4320-141-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4828-131-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads