Overview

overview

10

Static

static

b8c684115e...ff.exe

windows7-x64

10

b8c684115e...ff.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b8c684115ef6a43d97720eb9efdf1941b88eee7ffc46311eed9de21a5dd4b5ff

  • Size

    260KB

  • Sample

    221130-2mh7hafa3v

  • MD5

    0a7ec1e18be3324b19346c76e733e90e

  • SHA1

    0f2d16cdf58276e2c4dd34d55d6248e5e64f7fb6

  • SHA256

    b8c684115ef6a43d97720eb9efdf1941b88eee7ffc46311eed9de21a5dd4b5ff

  • SHA512

    ac4a70f5b0b4967e163d678b8c9ed616616c7e6029e19c1ae6803c0b092d7a574e0769a945eb303052c19f6c2b0b0a92600e8c7613aaba4d9451667c0a878341

  • SSDEEP

    6144:4ldeRqzOcjfsBkKzQCCcrQ/ei1IomAjSqwt0I+4:4/eRqDsQCZrJoxjbXI+4

Score
10/10
metasploitbackdoorevasionpersistencetrojanupx

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

    • Target

      b8c684115ef6a43d97720eb9efdf1941b88eee7ffc46311eed9de21a5dd4b5ff

    • Size

      260KB

    • MD5

      0a7ec1e18be3324b19346c76e733e90e

    • SHA1

      0f2d16cdf58276e2c4dd34d55d6248e5e64f7fb6

    • SHA256

      b8c684115ef6a43d97720eb9efdf1941b88eee7ffc46311eed9de21a5dd4b5ff

    • SHA512

      ac4a70f5b0b4967e163d678b8c9ed616616c7e6029e19c1ae6803c0b092d7a574e0769a945eb303052c19f6c2b0b0a92600e8c7613aaba4d9451667c0a878341

    • SSDEEP

      6144:4ldeRqzOcjfsBkKzQCCcrQ/ei1IomAjSqwt0I+4:4/eRqDsQCZrJoxjbXI+4

    Score
    10/10
    metasploitbackdoorevasionpersistencetrojanupx

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Modifies firewall policy service

      evasion

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Sets service image path in registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

3
T1060

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks