metasploit | 85f12250740d1be768cf62cb174e5bc1b5e4fb986115f4c1fb226c197f4c140c

Analysis

max time kernel
143s
max time network
153s
platform
windows7_x64
resource
win7-20220414-en
submitted
08-07-2022 17:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

85f12250740d1be768cf62cb174e5bc1b5e4fb986115f4c1fb226c197f4c140c.exe
Size

2.0MB
MD5

907653218f98010e9dd2759ca94a9556
SHA1

bc0e9c860734b67ac3c7cda7a4a174e379fdefa3
SHA256

85f12250740d1be768cf62cb174e5bc1b5e4fb986115f4c1fb226c197f4c140c
SHA512

e9da5d9ad778c61842e8d8255caebd62019257c27f23b7262b3f773d3b870a4c1bfc024e5758397918dad339c8e0ed6bb02ee8aed8294f782931beed4af97814

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

metasploit_stager

138.68.101.124:4444

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

85f12250740d1be768cf62cb174e5bc1b5e4fb986115f4c1fb226c197f4c140c.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	85f12250740d1be768cf62cb174e5bc1b5e4fb986115f4c1fb226c197f4c140c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	85f12250740d1be768cf62cb174e5bc1b5e4fb986115f4c1fb226c197f4c140c.exe

C:\Users\Admin\AppData\Local\Temp\85f12250740d1be768cf62cb174e5bc1b5e4fb986115f4c1fb226c197f4c140c.exe
"C:\Users\Admin\AppData\Local\Temp\85f12250740d1be768cf62cb174e5bc1b5e4fb986115f4c1fb226c197f4c140c.exe"
1⤵
- Checks BIOS information in registry
PID:1548

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1548-54-0x0000000140000000-0x0000000140493000-memory.dmp

Filesize
4.6MB

Download
memory/1548-55-0x0000000077870000-0x0000000077A19000-memory.dmp

Filesize
1.7MB

Download
memory/1548-56-0x0000000140000000-0x0000000140493000-memory.dmp

Filesize
4.6MB

Download