metasploit | bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd

General

Target

bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exe
Size

86KB
MD5

f89ebbcffd60792e25a7bf96a3278fba
SHA1

121df0f4ab4270e502efdcb0a3139969736c92ae
SHA256

bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd
SHA512

7764c274f14ba0ebc8032b3c8d725a8b946406df3d4647a13117531269340edd34eb1bccbd04e4c3ca9e4be5ab274ab405179fd2adba41334ee86f9724bffb3e
SSDEEP

1536:3qS4hV/JFlWb5lHbaaIXLN8Xj7fnfIMx8rf/xvgtYx8vT:MhV8b5lHGaUWz7ffHWrBvDGv

Score

10^/10

metasploit backdoor persistence trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft Driver Setup = "C:\\Windows\\system32\\drivers\\LBTWiz.exe"	bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exe

Drops file in Drivers directory 4 IoCs

Processes:

bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exeLBTWiz.exe

description	ioc	process
File created	C:\Windows\SysWOW64\drivers\LBTWiz.exe	bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exe
File opened for modification	C:\Windows\SysWOW64\drivers\LBTWiz.exe	bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exe
File opened for modification	C:\Windows\SysWOW64\drivers\LBTWiz.exe	LBTWiz.exe
File created	C:\Windows\SysWOW64\drivers\LBTWiz.exe	LBTWiz.exe

Executes dropped EXE 2 IoCs

Processes:

LBTWiz.exeLBTWiz.exe

pid process

2428 LBTWiz.exe
624 LBTWiz.exe

pid	process
2428	LBTWiz.exe
624	LBTWiz.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Driver Setup = "C:\\Windows\\system32\\drivers\\LBTWiz.exe"	bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exeLBTWiz.exe

description	pid	process	target process
PID 4996 set thread context of 3176	4996	bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exe	bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exe
PID 2428 set thread context of 624	2428	LBTWiz.exe	LBTWiz.exe

Drops file in Windows directory 1 IoCs

Processes:

LBTWiz.exe

description ioc process

File created C:\Windows\logfile32.txt LBTWiz.exe

description	ioc	process
File created	C:\Windows\logfile32.txt	LBTWiz.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exe

pid	process
3176	bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exe
3176	bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exe
3176	bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exe
3176	bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exebd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exeLBTWiz.exe

description	pid	process	target process
PID 4996 wrote to memory of 3176	4996	bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exe	bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exe
PID 4996 wrote to memory of 3176	4996	bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exe	bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exe
PID 4996 wrote to memory of 3176	4996	bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exe	bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exe
PID 4996 wrote to memory of 3176	4996	bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exe	bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exe
PID 4996 wrote to memory of 3176	4996	bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exe	bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exe
PID 3176 wrote to memory of 2428	3176	bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exe	LBTWiz.exe
PID 3176 wrote to memory of 2428	3176	bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exe	LBTWiz.exe
PID 3176 wrote to memory of 2428	3176	bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exe	LBTWiz.exe
PID 2428 wrote to memory of 624	2428	LBTWiz.exe	LBTWiz.exe
PID 2428 wrote to memory of 624	2428	LBTWiz.exe	LBTWiz.exe
PID 2428 wrote to memory of 624	2428	LBTWiz.exe	LBTWiz.exe
PID 2428 wrote to memory of 624	2428	LBTWiz.exe	LBTWiz.exe
PID 2428 wrote to memory of 624	2428	LBTWiz.exe	LBTWiz.exe

C:\Users\Admin\AppData\Local\Temp\bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exe
"C:\Users\Admin\AppData\Local\Temp\bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4996

C:\Users\Admin\AppData\Local\Temp\bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exe
"C:\Users\Admin\AppData\Local\Temp\bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd.exe"
2⤵
- Adds policy Run key to start application
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3176

C:\Windows\SysWOW64\drivers\LBTWiz.exe
"C:\Windows\system32\drivers\LBTWiz.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2428

C:\Windows\SysWOW64\drivers\LBTWiz.exe
"C:\Windows\SysWOW64\drivers\LBTWiz.exe"
4⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Windows directory
PID:624

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\drivers\LBTWiz.exe

Filesize
86KB

MD5
f89ebbcffd60792e25a7bf96a3278fba

SHA1
121df0f4ab4270e502efdcb0a3139969736c92ae

SHA256
bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd

SHA512
7764c274f14ba0ebc8032b3c8d725a8b946406df3d4647a13117531269340edd34eb1bccbd04e4c3ca9e4be5ab274ab405179fd2adba41334ee86f9724bffb3e

Download Submit
C:\Windows\SysWOW64\drivers\LBTWiz.exe

Filesize
86KB

MD5
f89ebbcffd60792e25a7bf96a3278fba

SHA1
121df0f4ab4270e502efdcb0a3139969736c92ae

SHA256
bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd

SHA512
7764c274f14ba0ebc8032b3c8d725a8b946406df3d4647a13117531269340edd34eb1bccbd04e4c3ca9e4be5ab274ab405179fd2adba41334ee86f9724bffb3e

Download Submit
C:\Windows\SysWOW64\drivers\LBTWiz.exe

Filesize
86KB

MD5
f89ebbcffd60792e25a7bf96a3278fba

SHA1
121df0f4ab4270e502efdcb0a3139969736c92ae

SHA256
bd1e53456c765350ba1997115d1875eed0513df871743dd0fc0b4bc7cabea3bd

SHA512
7764c274f14ba0ebc8032b3c8d725a8b946406df3d4647a13117531269340edd34eb1bccbd04e4c3ca9e4be5ab274ab405179fd2adba41334ee86f9724bffb3e

Download Submit
memory/624-150-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/624-144-0x0000000000000000-mapping.dmp

Download
memory/2428-149-0x0000000000400000-0x0000000000B74000-memory.dmp

Filesize
7.5MB

Download
memory/2428-143-0x0000000000400000-0x0000000000B74000-memory.dmp

Filesize
7.5MB

Download
memory/2428-139-0x0000000000000000-mapping.dmp

Download
memory/3176-136-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3176-142-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3176-138-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3176-134-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3176-133-0x0000000000000000-mapping.dmp

Download
memory/4996-137-0x0000000000400000-0x0000000000B74000-memory.dmp

Filesize
7.5MB

Download
memory/4996-132-0x0000000000400000-0x0000000000B74000-memory.dmp

Filesize
7.5MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads