metasploit | 66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab

Analysis

max time kernel
149s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 13:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe
Size

250KB
MD5

63803464e4117af6882f4909b3cf98f0
SHA1

7ebb2875eb8c694f33adeda6cf95ad47f182f39c
SHA256

66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab
SHA512

98c0e8b467f74ca3c7afc7368f98d15f773942e093555b9e8555afbb84c26229ff7a1d6c8a4478f32ad3d74de0ba415e051ef78a6de9f9a7c7bcc9c2c88ffc24
SSDEEP

3072:odcWrnfQGJSrb+FTGdlvLMlYmzqxuYkg3Rb3g3MUTjBDGsdFZTaho8bhDHV:OTfQGJSrKTG32hzqngH9qiZTahRbd1

Score

10^/10

metasploit backdoor persistence trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Executes dropped EXE 3 IoCs

pid	Process
3496	csrss.exe
3036	csrss.exe
1412	csrss.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Registry Service = "csrss.exe"	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 4648 set thread context of 2532	4648	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	82
PID 2532 set thread context of 4504	2532	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	83
PID 4504 set thread context of 1924	4504	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	84
PID 1924 set thread context of 1884	1924	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	85
PID 3496 set thread context of 3036	3496	csrss.exe	87
PID 3036 set thread context of 1412	3036	csrss.exe	88

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\csrss.exe	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe
File opened for modification	C:\Windows\csrss.exe	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 2532	4648	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	82
PID 4648 wrote to memory of 2532	4648	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	82
PID 4648 wrote to memory of 2532	4648	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	82
PID 4648 wrote to memory of 2532	4648	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	82
PID 4648 wrote to memory of 2532	4648	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	82
PID 4648 wrote to memory of 2532	4648	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	82
PID 4648 wrote to memory of 2532	4648	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	82
PID 4648 wrote to memory of 2532	4648	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	82
PID 4648 wrote to memory of 2532	4648	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	82
PID 4648 wrote to memory of 2532	4648	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	82
PID 4648 wrote to memory of 2532	4648	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	82
PID 2532 wrote to memory of 4504	2532	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	83
PID 2532 wrote to memory of 4504	2532	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	83
PID 2532 wrote to memory of 4504	2532	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	83
PID 4504 wrote to memory of 1924	4504	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	84
PID 4504 wrote to memory of 1924	4504	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	84
PID 4504 wrote to memory of 1924	4504	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	84
PID 4504 wrote to memory of 1924	4504	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	84
PID 4504 wrote to memory of 1924	4504	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	84
PID 4504 wrote to memory of 1924	4504	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	84
PID 4504 wrote to memory of 1924	4504	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	84
PID 4504 wrote to memory of 1924	4504	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	84
PID 4504 wrote to memory of 1924	4504	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	84
PID 4504 wrote to memory of 1924	4504	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	84
PID 4504 wrote to memory of 1924	4504	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	84
PID 1924 wrote to memory of 1884	1924	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	85
PID 1924 wrote to memory of 1884	1924	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	85
PID 1924 wrote to memory of 1884	1924	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	85
PID 1924 wrote to memory of 1884	1924	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	85
PID 1924 wrote to memory of 1884	1924	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	85
PID 1924 wrote to memory of 1884	1924	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	85
PID 1924 wrote to memory of 1884	1924	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	85
PID 1924 wrote to memory of 1884	1924	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	85
PID 1924 wrote to memory of 1884	1924	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	85
PID 1884 wrote to memory of 3496	1884	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	86
PID 1884 wrote to memory of 3496	1884	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	86
PID 1884 wrote to memory of 3496	1884	66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe	86
PID 3496 wrote to memory of 3036	3496	csrss.exe	87
PID 3496 wrote to memory of 3036	3496	csrss.exe	87
PID 3496 wrote to memory of 3036	3496	csrss.exe	87
PID 3496 wrote to memory of 3036	3496	csrss.exe	87
PID 3496 wrote to memory of 3036	3496	csrss.exe	87
PID 3496 wrote to memory of 3036	3496	csrss.exe	87
PID 3496 wrote to memory of 3036	3496	csrss.exe	87
PID 3496 wrote to memory of 3036	3496	csrss.exe	87
PID 3496 wrote to memory of 3036	3496	csrss.exe	87
PID 3496 wrote to memory of 3036	3496	csrss.exe	87
PID 3496 wrote to memory of 3036	3496	csrss.exe	87
PID 3036 wrote to memory of 1412	3036	csrss.exe	88
PID 3036 wrote to memory of 1412	3036	csrss.exe	88
PID 3036 wrote to memory of 1412	3036	csrss.exe	88
PID 3036 wrote to memory of 1412	3036	csrss.exe	88
PID 3036 wrote to memory of 1412	3036	csrss.exe	88
PID 3036 wrote to memory of 1412	3036	csrss.exe	88
PID 3036 wrote to memory of 1412	3036	csrss.exe	88
PID 3036 wrote to memory of 1412	3036	csrss.exe	88
PID 3036 wrote to memory of 1412	3036	csrss.exe	88

C:\Users\Admin\AppData\Local\Temp\66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe
"C:\Users\Admin\AppData\Local\Temp\66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Users\Admin\AppData\Local\Temp\66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe
  "C:\Users\Admin\AppData\Local\Temp\66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Users\Admin\AppData\Local\Temp\66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe
    "C:\Users\Admin\AppData\Local\Temp\66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe
      "C:\Users\Admin\AppData\Local\Temp\66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab.exe"
        5⤵
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:1884
      - C:\Windows\csrss.exe
        
        "C:\Windows\csrss.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3496
        
        C:\Windows\csrss.exe
        
        "C:\Windows\csrss.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3036
        
        C:\Windows\csrss.exe
        
        "C:\Windows\csrss.exe"
        8⤵
        Executes dropped EXE
        
        PID:1412

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\csrss.exe

Filesize
250KB

MD5
63803464e4117af6882f4909b3cf98f0

SHA1
7ebb2875eb8c694f33adeda6cf95ad47f182f39c

SHA256
66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab

SHA512
98c0e8b467f74ca3c7afc7368f98d15f773942e093555b9e8555afbb84c26229ff7a1d6c8a4478f32ad3d74de0ba415e051ef78a6de9f9a7c7bcc9c2c88ffc24

Download Submit
C:\Windows\csrss.exe

Filesize
250KB

MD5
63803464e4117af6882f4909b3cf98f0

SHA1
7ebb2875eb8c694f33adeda6cf95ad47f182f39c

SHA256
66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab

SHA512
98c0e8b467f74ca3c7afc7368f98d15f773942e093555b9e8555afbb84c26229ff7a1d6c8a4478f32ad3d74de0ba415e051ef78a6de9f9a7c7bcc9c2c88ffc24

Download Submit
C:\Windows\csrss.exe

Filesize
250KB

MD5
63803464e4117af6882f4909b3cf98f0

SHA1
7ebb2875eb8c694f33adeda6cf95ad47f182f39c

SHA256
66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab

SHA512
98c0e8b467f74ca3c7afc7368f98d15f773942e093555b9e8555afbb84c26229ff7a1d6c8a4478f32ad3d74de0ba415e051ef78a6de9f9a7c7bcc9c2c88ffc24

Download Submit
C:\Windows\csrss.exe

Filesize
250KB

MD5
63803464e4117af6882f4909b3cf98f0

SHA1
7ebb2875eb8c694f33adeda6cf95ad47f182f39c

SHA256
66782315c2d9ef5862b18fd353c79584f8fe2fc8cf62fde645bce3f45fe4e4ab

SHA512
98c0e8b467f74ca3c7afc7368f98d15f773942e093555b9e8555afbb84c26229ff7a1d6c8a4478f32ad3d74de0ba415e051ef78a6de9f9a7c7bcc9c2c88ffc24

Download Submit
memory/1412-164-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1412-163-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1884-147-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1884-158-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1884-146-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1884-143-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1924-144-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2532-133-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2532-137-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2532-135-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3036-160-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download