metasploit | 4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22

General

Target

4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe
Size

516KB
MD5

0d468d8b2a1f7f599575a60378554192
SHA1

2b3b2c9faf513e262ad623bd3c21ee4cc1a4ad2d
SHA256

4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22
SHA512

b009e1ff811fa525591ea9259b4c0d7b5e10c914dc8f8be7f0d6843c1beadf79305a96f60ad752922af95d25ef90adfa7c7485d9467130b44920faba9d11b747

Score

10^/10

metasploit backdoor persistence trojan upx

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Executes dropped EXE 5 IoCs

Processes:

AUE66.exemsn.exemsn.execsrss.execsrss.exe

pid process

4940 AUE66.exe
5076 msn.exe
1688 msn.exe
2204 csrss.exe
320 csrss.exe

pid	process
4940	AUE66.exe
5076	msn.exe
1688	msn.exe
2204	csrss.exe
320	csrss.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2348-138-0x0000000000400000-0x0000000000482000-memory.dmp	upx
behavioral2/memory/2348-140-0x0000000000400000-0x0000000000482000-memory.dmp	upx
behavioral2/memory/2348-141-0x0000000000400000-0x0000000000482000-memory.dmp	upx
behavioral2/memory/2348-144-0x0000000000400000-0x0000000000482000-memory.dmp	upx
behavioral2/memory/2348-154-0x0000000000400000-0x0000000000482000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AUE66.exe4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	AUE66.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msn.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	msn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Registry Service = "csrss.exe"	msn.exe

AutoIT Executable 6 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\F26D\msn.exe	autoit_exe
C:\Users\Admin\F26D\msn.exe	autoit_exe
C:\Users\Admin\F26D\msn.exe	autoit_exe
C:\Windows\csrss.exe	autoit_exe
C:\Windows\csrss.exe	autoit_exe
C:\Windows\csrss.exe	autoit_exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exemsn.execsrss.exe

description	pid	process	target process
PID 4572 set thread context of 2348	4572	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe
PID 4572 set thread context of 3120	4572	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe
PID 5076 set thread context of 1688	5076	msn.exe	msn.exe
PID 2204 set thread context of 320	2204	csrss.exe	csrss.exe

Drops file in Windows directory 2 IoCs

Processes:

msn.exe

description ioc process

File opened for modification C:\Windows\csrss.exe msn.exe
File created C:\Windows\csrss.exe msn.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

msn.execsrss.exe

pid process

5076 msn.exe
5076 msn.exe
2204 csrss.exe
2204 csrss.exe

description	ioc	process
File opened for modification	C:\Windows\csrss.exe	msn.exe
File created	C:\Windows\csrss.exe	msn.exe

pid	process
5076	msn.exe
5076	msn.exe
2204	csrss.exe
2204	csrss.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe

pid	process
4572	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe
2348	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exeAUE66.exemsn.exemsn.execsrss.exe

description	pid	process	target process
PID 4572 wrote to memory of 2348	4572	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe
PID 4572 wrote to memory of 2348	4572	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe
PID 4572 wrote to memory of 2348	4572	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe
PID 4572 wrote to memory of 2348	4572	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe
PID 4572 wrote to memory of 2348	4572	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe
PID 4572 wrote to memory of 2348	4572	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe
PID 4572 wrote to memory of 2348	4572	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe
PID 4572 wrote to memory of 2348	4572	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe
PID 4572 wrote to memory of 3120	4572	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe
PID 4572 wrote to memory of 3120	4572	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe
PID 4572 wrote to memory of 3120	4572	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe
PID 4572 wrote to memory of 3120	4572	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe
PID 4572 wrote to memory of 3120	4572	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe
PID 4572 wrote to memory of 3120	4572	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe
PID 2348 wrote to memory of 4940	2348	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe	AUE66.exe
PID 2348 wrote to memory of 4940	2348	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe	AUE66.exe
PID 2348 wrote to memory of 4940	2348	4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe	AUE66.exe
PID 4940 wrote to memory of 5076	4940	AUE66.exe	msn.exe
PID 4940 wrote to memory of 5076	4940	AUE66.exe	msn.exe
PID 4940 wrote to memory of 5076	4940	AUE66.exe	msn.exe
PID 5076 wrote to memory of 1688	5076	msn.exe	msn.exe
PID 5076 wrote to memory of 1688	5076	msn.exe	msn.exe
PID 5076 wrote to memory of 1688	5076	msn.exe	msn.exe
PID 5076 wrote to memory of 1688	5076	msn.exe	msn.exe
PID 5076 wrote to memory of 1688	5076	msn.exe	msn.exe
PID 5076 wrote to memory of 1688	5076	msn.exe	msn.exe
PID 5076 wrote to memory of 1688	5076	msn.exe	msn.exe
PID 5076 wrote to memory of 1688	5076	msn.exe	msn.exe
PID 5076 wrote to memory of 1688	5076	msn.exe	msn.exe
PID 1688 wrote to memory of 2204	1688	msn.exe	csrss.exe
PID 1688 wrote to memory of 2204	1688	msn.exe	csrss.exe
PID 1688 wrote to memory of 2204	1688	msn.exe	csrss.exe
PID 2204 wrote to memory of 320	2204	csrss.exe	csrss.exe
PID 2204 wrote to memory of 320	2204	csrss.exe	csrss.exe
PID 2204 wrote to memory of 320	2204	csrss.exe	csrss.exe
PID 2204 wrote to memory of 320	2204	csrss.exe	csrss.exe
PID 2204 wrote to memory of 320	2204	csrss.exe	csrss.exe
PID 2204 wrote to memory of 320	2204	csrss.exe	csrss.exe
PID 2204 wrote to memory of 320	2204	csrss.exe	csrss.exe
PID 2204 wrote to memory of 320	2204	csrss.exe	csrss.exe
PID 2204 wrote to memory of 320	2204	csrss.exe	csrss.exe

C:\Users\Admin\AppData\Local\Temp\4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe
"C:\Users\Admin\AppData\Local\Temp\4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4572

C:\Users\Admin\AppData\Local\Temp\4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe
"C:\Users\Admin\AppData\Local\Temp\4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe"
2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348

C:\Users\Admin\AppData\Local\Temp\AUE66.exe
"C:\Users\Admin\AppData\Local\Temp\AUE66.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4940

C:\Users\Admin\F26D\msn.exe
"C:\Users\Admin\F26D\msn.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5076

C:\Users\Admin\F26D\msn.exe
"C:\Users\Admin\F26D\msn.exe"
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\csrss.exe
"C:\Windows\csrss.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2204

C:\Windows\csrss.exe
"C:\Windows\csrss.exe"
7⤵
- Executes dropped EXE
PID:320

C:\Users\Admin\AppData\Local\Temp\4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe
"C:\Users\Admin\AppData\Local\Temp\4048086659a25f46c3bbe14643948d28ba004a68407476c5e8b95dfeca458b22.exe"
2⤵
PID:3120

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AUE66.exe
Filesize
483KB

MD5
846e69454ddca6f801239f0ff1e120be

SHA1
ff39cb2768bbf26e649892c01e470436f89f5599

SHA256
c6522bffd4b703164fed1600e3ecf2ef16d4b1b8b2493dcc8a1fca7ed3bfa65a

SHA512
b84870dca624e163417544e766165a5c2683faef5e78f36f68a5b5e84171d472ee0da5097728787ee3f2cc567101ce5e9f9c69f8f0788af60c7d5ad9da67fd22

Download Submit
C:\Users\Admin\AppData\Local\Temp\AUE66.exe
Filesize
483KB

MD5
846e69454ddca6f801239f0ff1e120be

SHA1
ff39cb2768bbf26e649892c01e470436f89f5599

SHA256
c6522bffd4b703164fed1600e3ecf2ef16d4b1b8b2493dcc8a1fca7ed3bfa65a

SHA512
b84870dca624e163417544e766165a5c2683faef5e78f36f68a5b5e84171d472ee0da5097728787ee3f2cc567101ce5e9f9c69f8f0788af60c7d5ad9da67fd22

Download Submit
C:\Users\Admin\F26D\msn.exe
Filesize
728KB

MD5
1838249f6e218963310b439c330e968f

SHA1
ede425b7e5bf6e48aad44911fc019d96860030b7

SHA256
e58756634c366fb6c92562750eab8f48f0044b8204e753dfee62b9c1c9c2b109

SHA512
f1226a8c44d788c3c1c7ff2a925f20bee61db43f193bcf862d503ab7f683869a0d64d7b4ecd017876e7ea494caa9a94a55b4e2155c116a3d53a5e5f2b93d0659

Download Submit
C:\Users\Admin\F26D\msn.exe
Filesize
728KB

MD5
1838249f6e218963310b439c330e968f

SHA1
ede425b7e5bf6e48aad44911fc019d96860030b7

SHA256
e58756634c366fb6c92562750eab8f48f0044b8204e753dfee62b9c1c9c2b109

SHA512
f1226a8c44d788c3c1c7ff2a925f20bee61db43f193bcf862d503ab7f683869a0d64d7b4ecd017876e7ea494caa9a94a55b4e2155c116a3d53a5e5f2b93d0659

Download Submit
C:\Users\Admin\F26D\msn.exe
Filesize
728KB

MD5
1838249f6e218963310b439c330e968f

SHA1
ede425b7e5bf6e48aad44911fc019d96860030b7

SHA256
e58756634c366fb6c92562750eab8f48f0044b8204e753dfee62b9c1c9c2b109

SHA512
f1226a8c44d788c3c1c7ff2a925f20bee61db43f193bcf862d503ab7f683869a0d64d7b4ecd017876e7ea494caa9a94a55b4e2155c116a3d53a5e5f2b93d0659

Download Submit
C:\Windows\csrss.exe
Filesize
728KB

MD5
1838249f6e218963310b439c330e968f

SHA1
ede425b7e5bf6e48aad44911fc019d96860030b7

SHA256
e58756634c366fb6c92562750eab8f48f0044b8204e753dfee62b9c1c9c2b109

SHA512
f1226a8c44d788c3c1c7ff2a925f20bee61db43f193bcf862d503ab7f683869a0d64d7b4ecd017876e7ea494caa9a94a55b4e2155c116a3d53a5e5f2b93d0659

Download Submit
C:\Windows\csrss.exe
Filesize
728KB

MD5
1838249f6e218963310b439c330e968f

SHA1
ede425b7e5bf6e48aad44911fc019d96860030b7

SHA256
e58756634c366fb6c92562750eab8f48f0044b8204e753dfee62b9c1c9c2b109

SHA512
f1226a8c44d788c3c1c7ff2a925f20bee61db43f193bcf862d503ab7f683869a0d64d7b4ecd017876e7ea494caa9a94a55b4e2155c116a3d53a5e5f2b93d0659

Download Submit
C:\Windows\csrss.exe
Filesize
728KB

MD5
1838249f6e218963310b439c330e968f

SHA1
ede425b7e5bf6e48aad44911fc019d96860030b7

SHA256
e58756634c366fb6c92562750eab8f48f0044b8204e753dfee62b9c1c9c2b109

SHA512
f1226a8c44d788c3c1c7ff2a925f20bee61db43f193bcf862d503ab7f683869a0d64d7b4ecd017876e7ea494caa9a94a55b4e2155c116a3d53a5e5f2b93d0659

Download Submit
memory/320-171-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/320-166-0x0000000000000000-mapping.dmp

Download
memory/1688-165-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1688-161-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1688-159-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1688-156-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1688-155-0x0000000000000000-mapping.dmp

Download
memory/2204-162-0x0000000000000000-mapping.dmp

Download
memory/2348-137-0x0000000000000000-mapping.dmp

Download
memory/2348-141-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2348-154-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2348-144-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2348-140-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2348-138-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3120-145-0x0000000000000000-mapping.dmp

Download
memory/3120-146-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4572-147-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/4572-132-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/4572-135-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/4572-134-0x0000000000650000-0x0000000000652000-memory.dmp

Filesize
8KB

Download
memory/4572-136-0x0000000000671000-0x0000000000673000-memory.dmp

Filesize
8KB

Download
memory/4940-148-0x0000000000000000-mapping.dmp

Download
memory/5076-151-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads