metasploit | c6f901faa3b3966b7d4e124e7b478a90f28b715ab2fca01665e9b173af99f2ce

Analysis

max time kernel
94s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2022 02:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c6f901faa3b3966b7d4e124e7b478a90f28b715ab2fca01665e9b173af99f2ce.exe
Size

160KB
MD5

b1fcf1443438b8eb8eb6b77e7cf3fe10
SHA1

4041e9288c79b3fb284c0c89e4f289a7eb09ff51
SHA256

c6f901faa3b3966b7d4e124e7b478a90f28b715ab2fca01665e9b173af99f2ce
SHA512

b6927331c7ac243b718d0b6778eb0cd2c214357741b7bf8a281842474d8b7cebbceca1f12df3b1d74b6c107e4f2581d368fde01244973e85a86de41dcd8edbe4
SSDEEP

3072:Gc/cM53ThfUe3p2QTozjoHlgGPDRQPL1yo+xISLH:7cMZThfUe3proz0FB7ihfS5LH

Score

10^/10

metasploit backdoor bootkit persistence trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

c6f901faa3b3966b7d4e124e7b478a90f28b715ab2fca01665e9b173af99f2ce.exe

description ioc process

File opened for modification \??\PhysicalDrive0 c6f901faa3b3966b7d4e124e7b478a90f28b715ab2fca01665e9b173af99f2ce.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	c6f901faa3b3966b7d4e124e7b478a90f28b715ab2fca01665e9b173af99f2ce.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

c6f901faa3b3966b7d4e124e7b478a90f28b715ab2fca01665e9b173af99f2ce.exe

description	pid	process	target process
PID 1156 set thread context of 4080	1156	c6f901faa3b3966b7d4e124e7b478a90f28b715ab2fca01665e9b173af99f2ce.exe	c6f901faa3b3966b7d4e124e7b478a90f28b715ab2fca01665e9b173af99f2ce.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

c6f901faa3b3966b7d4e124e7b478a90f28b715ab2fca01665e9b173af99f2ce.exe

pid process

1156 c6f901faa3b3966b7d4e124e7b478a90f28b715ab2fca01665e9b173af99f2ce.exe

pid	process
1156	c6f901faa3b3966b7d4e124e7b478a90f28b715ab2fca01665e9b173af99f2ce.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

c6f901faa3b3966b7d4e124e7b478a90f28b715ab2fca01665e9b173af99f2ce.exe

description	pid	process	target process
PID 1156 wrote to memory of 4080	1156	c6f901faa3b3966b7d4e124e7b478a90f28b715ab2fca01665e9b173af99f2ce.exe	c6f901faa3b3966b7d4e124e7b478a90f28b715ab2fca01665e9b173af99f2ce.exe
PID 1156 wrote to memory of 4080	1156	c6f901faa3b3966b7d4e124e7b478a90f28b715ab2fca01665e9b173af99f2ce.exe	c6f901faa3b3966b7d4e124e7b478a90f28b715ab2fca01665e9b173af99f2ce.exe
PID 1156 wrote to memory of 4080	1156	c6f901faa3b3966b7d4e124e7b478a90f28b715ab2fca01665e9b173af99f2ce.exe	c6f901faa3b3966b7d4e124e7b478a90f28b715ab2fca01665e9b173af99f2ce.exe
PID 1156 wrote to memory of 4080	1156	c6f901faa3b3966b7d4e124e7b478a90f28b715ab2fca01665e9b173af99f2ce.exe	c6f901faa3b3966b7d4e124e7b478a90f28b715ab2fca01665e9b173af99f2ce.exe
PID 1156 wrote to memory of 4080	1156	c6f901faa3b3966b7d4e124e7b478a90f28b715ab2fca01665e9b173af99f2ce.exe	c6f901faa3b3966b7d4e124e7b478a90f28b715ab2fca01665e9b173af99f2ce.exe
PID 1156 wrote to memory of 4080	1156	c6f901faa3b3966b7d4e124e7b478a90f28b715ab2fca01665e9b173af99f2ce.exe	c6f901faa3b3966b7d4e124e7b478a90f28b715ab2fca01665e9b173af99f2ce.exe
PID 1156 wrote to memory of 4080	1156	c6f901faa3b3966b7d4e124e7b478a90f28b715ab2fca01665e9b173af99f2ce.exe	c6f901faa3b3966b7d4e124e7b478a90f28b715ab2fca01665e9b173af99f2ce.exe
PID 1156 wrote to memory of 4080	1156	c6f901faa3b3966b7d4e124e7b478a90f28b715ab2fca01665e9b173af99f2ce.exe	c6f901faa3b3966b7d4e124e7b478a90f28b715ab2fca01665e9b173af99f2ce.exe
PID 1156 wrote to memory of 4080	1156	c6f901faa3b3966b7d4e124e7b478a90f28b715ab2fca01665e9b173af99f2ce.exe	c6f901faa3b3966b7d4e124e7b478a90f28b715ab2fca01665e9b173af99f2ce.exe

C:\Users\Admin\AppData\Local\Temp\c6f901faa3b3966b7d4e124e7b478a90f28b715ab2fca01665e9b173af99f2ce.exe
"C:\Users\Admin\AppData\Local\Temp\c6f901faa3b3966b7d4e124e7b478a90f28b715ab2fca01665e9b173af99f2ce.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1156

C:\Users\Admin\AppData\Local\Temp\c6f901faa3b3966b7d4e124e7b478a90f28b715ab2fca01665e9b173af99f2ce.exe
"C:\Users\Admin\AppData\Local\Temp\c6f901faa3b3966b7d4e124e7b478a90f28b715ab2fca01665e9b173af99f2ce.exe"
2⤵
PID:4080

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4080-134-0x0000000000000000-mapping.dmp

Download
memory/4080-135-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4080-136-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download