metasploit | 81502a2ee972e833e65392ee66110eccee50301c9aab45a25965968ad529b1a0

Analysis

max time kernel
139s
max time network
157s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 15:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81502a2ee972e833e65392ee66110eccee50301c9aab45a25965968ad529b1a0.exe
Size

2.2MB
MD5

2ecc4a411fea698ec1125c06003f7deb
SHA1

b9d1031749f9e3587283a331bd1ed3237007173c
SHA256

81502a2ee972e833e65392ee66110eccee50301c9aab45a25965968ad529b1a0
SHA512

b9a284074251884ab3ebf9c4e62abae2e6b4fca6b8f71edf824c82edb23d1115423bb8479727d582852078db829cb15efcb2575247281d3747e002dfc64ef384
SSDEEP

49152:L54dPdIAAgDebOqPV79fKoDyQRGH3bDcNGNd39Ie6Lw:F4hdF91qPV7JvRGH3UE19h

Score

10^/10

metasploit backdoor evasion trojan upx

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Executes dropped EXE 1 IoCs

pid	Process
960	bot.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	81502a2ee972e833e65392ee66110eccee50301c9aab45a25965968ad529b1a0.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	bot.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2028-54-0x0000000000400000-0x00000000007C7000-memory.dmp	upx
behavioral1/memory/2028-55-0x0000000000400000-0x00000000007C7000-memory.dmp	upx
behavioral1/memory/2028-63-0x0000000000400000-0x00000000007C7000-memory.dmp	upx
behavioral1/files/0x0009000000014219-68.dat	upx
behavioral1/memory/960-69-0x0000000000400000-0x00000000007C7000-memory.dmp	upx
behavioral1/memory/960-70-0x0000000000400000-0x00000000007C7000-memory.dmp	upx
behavioral1/memory/960-80-0x0000000000400000-0x00000000007C7000-memory.dmp	upx
behavioral1/memory/2028-84-0x0000000000400000-0x00000000007C7000-memory.dmp	upx
behavioral1/memory/960-86-0x0000000000400000-0x00000000007C7000-memory.dmp	upx
behavioral1/memory/960-87-0x0000000000400000-0x00000000007C7000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
960	bot.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Wine	81502a2ee972e833e65392ee66110eccee50301c9aab45a25965968ad529b1a0.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\i	cmd.exe
File opened for modification	C:\Windows\SysWOW64\i	cmd.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	bot.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2028	81502a2ee972e833e65392ee66110eccee50301c9aab45a25965968ad529b1a0.exe
960	bot.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\bot.exe	81502a2ee972e833e65392ee66110eccee50301c9aab45a25965968ad529b1a0.exe
File opened for modification	C:\Windows\bot.exe	81502a2ee972e833e65392ee66110eccee50301c9aab45a25965968ad529b1a0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	bot.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	bot.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	bot.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	bot.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	bot.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	bot.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	bot.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	bot.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	bot.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2028	81502a2ee972e833e65392ee66110eccee50301c9aab45a25965968ad529b1a0.exe
960	bot.exe
960	bot.exe
960	bot.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	960	bot.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 524	2028	81502a2ee972e833e65392ee66110eccee50301c9aab45a25965968ad529b1a0.exe	26
PID 2028 wrote to memory of 524	2028	81502a2ee972e833e65392ee66110eccee50301c9aab45a25965968ad529b1a0.exe	26
PID 2028 wrote to memory of 524	2028	81502a2ee972e833e65392ee66110eccee50301c9aab45a25965968ad529b1a0.exe	26
PID 2028 wrote to memory of 524	2028	81502a2ee972e833e65392ee66110eccee50301c9aab45a25965968ad529b1a0.exe	26
PID 2028 wrote to memory of 2008	2028	81502a2ee972e833e65392ee66110eccee50301c9aab45a25965968ad529b1a0.exe	28
PID 2028 wrote to memory of 2008	2028	81502a2ee972e833e65392ee66110eccee50301c9aab45a25965968ad529b1a0.exe	28
PID 2028 wrote to memory of 2008	2028	81502a2ee972e833e65392ee66110eccee50301c9aab45a25965968ad529b1a0.exe	28
PID 2028 wrote to memory of 2008	2028	81502a2ee972e833e65392ee66110eccee50301c9aab45a25965968ad529b1a0.exe	28
PID 524 wrote to memory of 568	524	cmd.exe	30
PID 524 wrote to memory of 568	524	cmd.exe	30
PID 524 wrote to memory of 568	524	cmd.exe	30
PID 524 wrote to memory of 568	524	cmd.exe	30
PID 2008 wrote to memory of 900	2008	cmd.exe	31
PID 2008 wrote to memory of 900	2008	cmd.exe	31
PID 2008 wrote to memory of 900	2008	cmd.exe	31
PID 2008 wrote to memory of 900	2008	cmd.exe	31
PID 900 wrote to memory of 1380	900	net.exe	32
PID 900 wrote to memory of 1380	900	net.exe	32
PID 900 wrote to memory of 1380	900	net.exe	32
PID 900 wrote to memory of 1380	900	net.exe	32
PID 2008 wrote to memory of 1240	2008	cmd.exe	33
PID 2008 wrote to memory of 1240	2008	cmd.exe	33
PID 2008 wrote to memory of 1240	2008	cmd.exe	33
PID 2008 wrote to memory of 1240	2008	cmd.exe	33
PID 1240 wrote to memory of 848	1240	net.exe	34
PID 1240 wrote to memory of 848	1240	net.exe	34
PID 1240 wrote to memory of 848	1240	net.exe	34
PID 1240 wrote to memory of 848	1240	net.exe	34
PID 960 wrote to memory of 1884	960	bot.exe	36
PID 960 wrote to memory of 1884	960	bot.exe	36
PID 960 wrote to memory of 1884	960	bot.exe	36
PID 960 wrote to memory of 1884	960	bot.exe	36
PID 960 wrote to memory of 1016	960	bot.exe	38
PID 960 wrote to memory of 1016	960	bot.exe	38
PID 960 wrote to memory of 1016	960	bot.exe	38
PID 960 wrote to memory of 1016	960	bot.exe	38
PID 1016 wrote to memory of 660	1016	cmd.exe	40
PID 1016 wrote to memory of 660	1016	cmd.exe	40
PID 1016 wrote to memory of 660	1016	cmd.exe	40
PID 1016 wrote to memory of 660	1016	cmd.exe	40
PID 1884 wrote to memory of 1604	1884	cmd.exe	42
PID 1884 wrote to memory of 1604	1884	cmd.exe	42
PID 1884 wrote to memory of 1604	1884	cmd.exe	42
PID 1884 wrote to memory of 1604	1884	cmd.exe	42
PID 660 wrote to memory of 472	660	net.exe	41
PID 660 wrote to memory of 472	660	net.exe	41
PID 660 wrote to memory of 472	660	net.exe	41
PID 660 wrote to memory of 472	660	net.exe	41
PID 1016 wrote to memory of 1768	1016	cmd.exe	43
PID 1016 wrote to memory of 1768	1016	cmd.exe	43
PID 1016 wrote to memory of 1768	1016	cmd.exe	43
PID 1016 wrote to memory of 1768	1016	cmd.exe	43
PID 1768 wrote to memory of 1212	1768	net.exe	44
PID 1768 wrote to memory of 1212	1768	net.exe	44
PID 1768 wrote to memory of 1212	1768	net.exe	44
PID 1768 wrote to memory of 1212	1768	net.exe	44

C:\Users\Admin\AppData\Local\Temp\81502a2ee972e833e65392ee66110eccee50301c9aab45a25965968ad529b1a0.exe
"C:\Users\Admin\AppData\Local\Temp\81502a2ee972e833e65392ee66110eccee50301c9aab45a25965968ad529b1a0.exe"
1⤵
- Looks for VMWare Tools registry key
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\b.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:524
- - C:\Windows\SysWOW64\ftp.exe
    ftp -As:i
    3⤵
    PID:568
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\a.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\SysWOW64\net.exe
    net stop "Security Center"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:900
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Security Center"
      4⤵
      PID:1380
- - C:\Windows\SysWOW64\net.exe
    net stop winvnc4
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1240
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop winvnc4
      4⤵
      PID:848

C:\Windows\bot.exe
"C:\Windows\bot.exe"
1⤵
- Executes dropped EXE
- Looks for VMWare Tools registry key
- Deletes itself
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\b.bat" "
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Windows\SysWOW64\ftp.exe
    ftp -As:i
    3⤵
    PID:1604
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\a.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\Windows\SysWOW64\net.exe
    net stop "Security Center"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:660
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Security Center"
      4⤵
      PID:472
- - C:\Windows\SysWOW64\net.exe
    net stop winvnc4
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1768
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop winvnc4
      4⤵
      PID:1212

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\i

Filesize
54B

MD5
e565749d661936b2dee64731bb34f3a5

SHA1
b9b4b4ff5616344d0d8482765ef64ffa583da679

SHA256
5fce898aacd4421bd29a8e4ac7cee1390b93e3d77198f220afc2dddc9062806d

SHA512
fde7b9f7a7dd90520943ae7af1fcdaa49c8b1478bb4ec5ef5915777a83e0361ffc0a647cb1b3dd74c255fdffcbca8488de9209e79d9020147336df4534e29823

Download Submit
C:\Windows\SysWOW64\i

Filesize
54B

MD5
e565749d661936b2dee64731bb34f3a5

SHA1
b9b4b4ff5616344d0d8482765ef64ffa583da679

SHA256
5fce898aacd4421bd29a8e4ac7cee1390b93e3d77198f220afc2dddc9062806d

SHA512
fde7b9f7a7dd90520943ae7af1fcdaa49c8b1478bb4ec5ef5915777a83e0361ffc0a647cb1b3dd74c255fdffcbca8488de9209e79d9020147336df4534e29823

Download Submit
C:\Windows\bot.exe

Filesize
2.2MB

MD5
2ecc4a411fea698ec1125c06003f7deb

SHA1
b9d1031749f9e3587283a331bd1ed3237007173c

SHA256
81502a2ee972e833e65392ee66110eccee50301c9aab45a25965968ad529b1a0

SHA512
b9a284074251884ab3ebf9c4e62abae2e6b4fca6b8f71edf824c82edb23d1115423bb8479727d582852078db829cb15efcb2575247281d3747e002dfc64ef384

Download Submit
C:\a.bat

Filesize
71B

MD5
4db2c561024318efaf926a8e0a6ebc36

SHA1
8e3060152b239e7c7bc488e79030b9e3c13de066

SHA256
f9ea85780a059d9338c359925ec487588102ef55be4062ec4ac19efc8af59f0f

SHA512
df700bc9348e147ceb1db687974c567fdff052d73eb4709b718f3b3dfaf44116a5a70c0ae62438416888c0783a575e524f501da1308bbc987443ec3c852bef99

Download Submit
C:\a.bat

Filesize
71B

MD5
4db2c561024318efaf926a8e0a6ebc36

SHA1
8e3060152b239e7c7bc488e79030b9e3c13de066

SHA256
f9ea85780a059d9338c359925ec487588102ef55be4062ec4ac19efc8af59f0f

SHA512
df700bc9348e147ceb1db687974c567fdff052d73eb4709b718f3b3dfaf44116a5a70c0ae62438416888c0783a575e524f501da1308bbc987443ec3c852bef99

Download Submit
C:\b.bat

Filesize
119B

MD5
ba471466c8774e3f96da5d58fb0efdb6

SHA1
6c18ed4314156174186eed0471a03e69e43356f0

SHA256
70c08f681ca24f5dfc6655212806c460c25e4ab2c3b5e480a656253706298c3a

SHA512
9ad2072e87cdcd3b8a5542be6fbc64baae4e82b5323fa525a2e575b7e4123584818992131d635dac5088152cc066277f054031a4d83a1a22b2968fdffca5504c

Download Submit
C:\b.bat

Filesize
119B

MD5
ba471466c8774e3f96da5d58fb0efdb6

SHA1
6c18ed4314156174186eed0471a03e69e43356f0

SHA256
70c08f681ca24f5dfc6655212806c460c25e4ab2c3b5e480a656253706298c3a

SHA512
9ad2072e87cdcd3b8a5542be6fbc64baae4e82b5323fa525a2e575b7e4123584818992131d635dac5088152cc066277f054031a4d83a1a22b2968fdffca5504c

Download Submit
memory/960-80-0x0000000000400000-0x00000000007C7000-memory.dmp

Filesize
3.8MB

Download
memory/960-69-0x0000000000400000-0x00000000007C7000-memory.dmp

Filesize
3.8MB

Download
memory/960-70-0x0000000000400000-0x00000000007C7000-memory.dmp

Filesize
3.8MB

Download
memory/960-87-0x0000000000400000-0x00000000007C7000-memory.dmp

Filesize
3.8MB

Download
memory/960-86-0x0000000000400000-0x00000000007C7000-memory.dmp

Filesize
3.8MB

Download
memory/2028-55-0x0000000000400000-0x00000000007C7000-memory.dmp

Filesize
3.8MB

Download
memory/2028-56-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download
memory/2028-84-0x0000000000400000-0x00000000007C7000-memory.dmp

Filesize
3.8MB

Download
memory/2028-54-0x0000000000400000-0x00000000007C7000-memory.dmp

Filesize
3.8MB

Download
memory/2028-63-0x0000000000400000-0x00000000007C7000-memory.dmp

Filesize
3.8MB

Download