metasploit | 2e16db2356a1eceedd9cc7a5a60725d19a6e860da2ae1c4921fc38dfbe79347e

Analysis

max time kernel
147s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 08:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e16db2356a1eceedd9cc7a5a60725d19a6e860da2ae1c4921fc38dfbe79347e.exe
Size

41KB
MD5

6756602c5b20bc72b6bd3f5b739168d0
SHA1

3152db00257ea8563d542c0a3be36bb23e57c8cc
SHA256

2e16db2356a1eceedd9cc7a5a60725d19a6e860da2ae1c4921fc38dfbe79347e
SHA512

fd1caca1d0a2812b7103c0b6b6b067f422d5a8864c20ddd4f892e9901351585d19fb821b2e9fbac9080bede9c5bab164c6855544e9fda109c18c3acc147d5d5f
SSDEEP

768:+4bahcsaOx7kR0HW6eqvsNwhK+E6Yb2oD7tedlApAKeLLcuTJGAZUDIWFdzRPqPF:+IS9xdHW6ANwMRCbTZ3JGsmpdtPqoO

Score

10^/10

metasploit backdoor persistence trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	2e16db2356a1eceedd9cc7a5a60725d19a6e860da2ae1c4921fc38dfbe79347e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft Driver Setup = "C:\\Windows\\sadrive32.exe"	2e16db2356a1eceedd9cc7a5a60725d19a6e860da2ae1c4921fc38dfbe79347e.exe

Executes dropped EXE 1 IoCs

pid	Process
4572	sadrive32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	2e16db2356a1eceedd9cc7a5a60725d19a6e860da2ae1c4921fc38dfbe79347e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Driver Setup = "C:\\Windows\\sadrive32.exe"	2e16db2356a1eceedd9cc7a5a60725d19a6e860da2ae1c4921fc38dfbe79347e.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\sadrive32.exe	2e16db2356a1eceedd9cc7a5a60725d19a6e860da2ae1c4921fc38dfbe79347e.exe
File opened for modification	C:\Windows\sadrive32.exe	2e16db2356a1eceedd9cc7a5a60725d19a6e860da2ae1c4921fc38dfbe79347e.exe
File created	C:\Windows\%windir%\lfffile32.log	sadrive32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2524	2e16db2356a1eceedd9cc7a5a60725d19a6e860da2ae1c4921fc38dfbe79347e.exe
2524	2e16db2356a1eceedd9cc7a5a60725d19a6e860da2ae1c4921fc38dfbe79347e.exe
2524	2e16db2356a1eceedd9cc7a5a60725d19a6e860da2ae1c4921fc38dfbe79347e.exe
2524	2e16db2356a1eceedd9cc7a5a60725d19a6e860da2ae1c4921fc38dfbe79347e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 4572	2524	2e16db2356a1eceedd9cc7a5a60725d19a6e860da2ae1c4921fc38dfbe79347e.exe	77
PID 2524 wrote to memory of 4572	2524	2e16db2356a1eceedd9cc7a5a60725d19a6e860da2ae1c4921fc38dfbe79347e.exe	77
PID 2524 wrote to memory of 4572	2524	2e16db2356a1eceedd9cc7a5a60725d19a6e860da2ae1c4921fc38dfbe79347e.exe	77

C:\Users\Admin\AppData\Local\Temp\2e16db2356a1eceedd9cc7a5a60725d19a6e860da2ae1c4921fc38dfbe79347e.exe
"C:\Users\Admin\AppData\Local\Temp\2e16db2356a1eceedd9cc7a5a60725d19a6e860da2ae1c4921fc38dfbe79347e.exe"
1⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\sadrive32.exe
  "C:\Windows\sadrive32.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:4572

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\sadrive32.exe

Filesize
41KB

MD5
6756602c5b20bc72b6bd3f5b739168d0

SHA1
3152db00257ea8563d542c0a3be36bb23e57c8cc

SHA256
2e16db2356a1eceedd9cc7a5a60725d19a6e860da2ae1c4921fc38dfbe79347e

SHA512
fd1caca1d0a2812b7103c0b6b6b067f422d5a8864c20ddd4f892e9901351585d19fb821b2e9fbac9080bede9c5bab164c6855544e9fda109c18c3acc147d5d5f

Download Submit
C:\Windows\sadrive32.exe

Filesize
41KB

MD5
6756602c5b20bc72b6bd3f5b739168d0

SHA1
3152db00257ea8563d542c0a3be36bb23e57c8cc

SHA256
2e16db2356a1eceedd9cc7a5a60725d19a6e860da2ae1c4921fc38dfbe79347e

SHA512
fd1caca1d0a2812b7103c0b6b6b067f422d5a8864c20ddd4f892e9901351585d19fb821b2e9fbac9080bede9c5bab164c6855544e9fda109c18c3acc147d5d5f

Download Submit
memory/2524-132-0x0000000000700000-0x0000000000708000-memory.dmp

Filesize
32KB

Download
memory/2524-133-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2524-139-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4572-137-0x00000000007B0000-0x00000000007B8000-memory.dmp

Filesize
32KB

Download
memory/4572-138-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4572-140-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download