metasploit | 150ae2d57a09fd1b2a6ad8d34362cade0d0cdd3d9db762f995b6ab8f0be32445

General

Target

150ae2d57a09fd1b2a6ad8d34362cade0d0cdd3d9db762f995b6ab8f0be32445.exe
Size

574KB
MD5

6cded01b63fa3a3bd8a9ad88b3ebcbb6
SHA1

97450ff3b0e6f0ec33cef13f6b203e14423fcf9b
SHA256

150ae2d57a09fd1b2a6ad8d34362cade0d0cdd3d9db762f995b6ab8f0be32445
SHA512

2c7b52f7ed561c8026a4eb9a6ee04fadfdd5d0f83be3439596b5bb8f0f05d90718306bf6d05e8bfdf310e866e26d4f079fcbad17b5e5fcd794efc930d4011f8f
SSDEEP

12288:0QpNPhKo149mbgiR2zPMXxMVEkuBZuO9yjREt:Rb5Co0zkhoXuaOQ2

Score

10^/10

metasploit backdoor evasion trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\sysdrv32.sys	wmisvmgr.exe

Executes dropped EXE 1 IoCs

pid	Process
784	wmisvmgr.exe

Deletes itself 1 IoCs

pid	Process
784	wmisvmgr.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Wine	150ae2d57a09fd1b2a6ad8d34362cade0d0cdd3d9db762f995b6ab8f0be32445.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	wmisvmgr.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1884	150ae2d57a09fd1b2a6ad8d34362cade0d0cdd3d9db762f995b6ab8f0be32445.exe
784	wmisvmgr.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system\wmisvmgr.exe	150ae2d57a09fd1b2a6ad8d34362cade0d0cdd3d9db762f995b6ab8f0be32445.exe
File opened for modification	C:\Windows\system\wmisvmgr.exe	150ae2d57a09fd1b2a6ad8d34362cade0d0cdd3d9db762f995b6ab8f0be32445.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	wmisvmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	wmisvmgr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	wmisvmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	wmisvmgr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	wmisvmgr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	wmisvmgr.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1884	150ae2d57a09fd1b2a6ad8d34362cade0d0cdd3d9db762f995b6ab8f0be32445.exe
784	wmisvmgr.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

C:\Users\Admin\AppData\Local\Temp\150ae2d57a09fd1b2a6ad8d34362cade0d0cdd3d9db762f995b6ab8f0be32445.exe
"C:\Users\Admin\AppData\Local\Temp\150ae2d57a09fd1b2a6ad8d34362cade0d0cdd3d9db762f995b6ab8f0be32445.exe"
1⤵
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1884

C:\Windows\system\wmisvmgr.exe
"C:\Windows\system\wmisvmgr.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Deletes itself
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

1

T1012

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\wmisvmgr.exe

Filesize
574KB

MD5
6cded01b63fa3a3bd8a9ad88b3ebcbb6

SHA1
97450ff3b0e6f0ec33cef13f6b203e14423fcf9b

SHA256
150ae2d57a09fd1b2a6ad8d34362cade0d0cdd3d9db762f995b6ab8f0be32445

SHA512
2c7b52f7ed561c8026a4eb9a6ee04fadfdd5d0f83be3439596b5bb8f0f05d90718306bf6d05e8bfdf310e866e26d4f079fcbad17b5e5fcd794efc930d4011f8f

Download Submit
C:\Windows\system\wmisvmgr.exe

Filesize
574KB

MD5
6cded01b63fa3a3bd8a9ad88b3ebcbb6

SHA1
97450ff3b0e6f0ec33cef13f6b203e14423fcf9b

SHA256
150ae2d57a09fd1b2a6ad8d34362cade0d0cdd3d9db762f995b6ab8f0be32445

SHA512
2c7b52f7ed561c8026a4eb9a6ee04fadfdd5d0f83be3439596b5bb8f0f05d90718306bf6d05e8bfdf310e866e26d4f079fcbad17b5e5fcd794efc930d4011f8f

Download Submit
memory/784-59-0x0000000000400000-0x00000000005AE000-memory.dmp

Filesize
1.7MB

Download
memory/784-62-0x0000000000400000-0x00000000005AE000-memory.dmp

Filesize
1.7MB

Download
memory/784-64-0x0000000000400000-0x00000000005AE000-memory.dmp

Filesize
1.7MB

Download
memory/784-65-0x0000000000400000-0x00000000005AE000-memory.dmp

Filesize
1.7MB

Download
memory/1884-54-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download
memory/1884-55-0x0000000000400000-0x00000000005AE000-memory.dmp

Filesize
1.7MB

Download
memory/1884-56-0x0000000000400000-0x00000000005AE000-memory.dmp

Filesize
1.7MB

Download
memory/1884-57-0x0000000000400000-0x00000000005AE000-memory.dmp

Filesize
1.7MB

Download
memory/1884-61-0x0000000000400000-0x00000000005AE000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads