metasploit | fe35083f33fc7e3dabfd966feaa88363feb038c9ec7580e27800cde25855a3ad

Analysis

max time kernel
36s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 13:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe35083f33fc7e3dabfd966feaa88363feb038c9ec7580e27800cde25855a3ad.exe
Size

134KB
MD5

168f4c1be4f7ca043efd6b24b98d81d0
SHA1

1007d485e4a7700bd3cef50f786422f299510825
SHA256

fe35083f33fc7e3dabfd966feaa88363feb038c9ec7580e27800cde25855a3ad
SHA512

242aadc5471664efe591921dcf3e186449764c502873183065faa049936fdbb85cbb1b30b5b4072ddd654276447f6d0afbbc37a955528da138dac8c31c1ba669
SSDEEP

3072:YCi+6hOpjroqK48pYZqHOoQy2EW9YxNVAZ/9Cqs:if8vos8p93QF1IY/Aqs

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Deletes itself 1 IoCs

pid	Process
1860	cmd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dllcache\qxchost.exe	fe35083f33fc7e3dabfd966feaa88363feb038c9ec7580e27800cde25855a3ad.exe
File opened for modification	C:\Windows\SysWOW64\dllcache\qxchost.exe	fe35083f33fc7e3dabfd966feaa88363feb038c9ec7580e27800cde25855a3ad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 1860	364	fe35083f33fc7e3dabfd966feaa88363feb038c9ec7580e27800cde25855a3ad.exe	26
PID 364 wrote to memory of 1860	364	fe35083f33fc7e3dabfd966feaa88363feb038c9ec7580e27800cde25855a3ad.exe	26
PID 364 wrote to memory of 1860	364	fe35083f33fc7e3dabfd966feaa88363feb038c9ec7580e27800cde25855a3ad.exe	26
PID 364 wrote to memory of 1860	364	fe35083f33fc7e3dabfd966feaa88363feb038c9ec7580e27800cde25855a3ad.exe	26

C:\Users\Admin\AppData\Local\Temp\fe35083f33fc7e3dabfd966feaa88363feb038c9ec7580e27800cde25855a3ad.exe
"C:\Users\Admin\AppData\Local\Temp\fe35083f33fc7e3dabfd966feaa88363feb038c9ec7580e27800cde25855a3ad.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:364
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\FE3508~1.EXE >> NUL
  2⤵
  - Deletes itself
  PID:1860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/364-54-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/364-55-0x00000000004C0000-0x0000000000506000-memory.dmp

Filesize
280KB

Download
memory/364-56-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/364-57-0x0000000000260000-0x0000000000263000-memory.dmp

Filesize
12KB

Download
memory/364-58-0x0000000000270000-0x0000000000289000-memory.dmp

Filesize
100KB

Download
memory/364-59-0x00000000004C0000-0x0000000000506000-memory.dmp

Filesize
280KB

Download
memory/364-61-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1860-60-0x0000000000000000-mapping.dmp

Download