metasploit | 67ca6587860f9d0df59e660eb21891dda49368ee004705c25b8dc613ea9fa37b

General

Target

67ca6587860f9d0df59e660eb21891dda49368ee004705c25b8dc613ea9fa37b.exe
Size

204KB
MD5

e0645978c758b3a5b4d96a5a0a37ff64
SHA1

9564de281369f4d8bc9253596bb7c15f3f970cc4
SHA256

67ca6587860f9d0df59e660eb21891dda49368ee004705c25b8dc613ea9fa37b
SHA512

7473eb01a90b739c7ffb94bd32dd77531daf19688086ca82416a41921e119369c4df2e6599033c9ecbaf346bfbd0ac5a3d1d35be993d3183e18bb0071b2ee9fc
SSDEEP

3072:VD/rDkIFvYwWkr66AOq+sIcvax+zlu2KOlXAharwCoDUC8twEw5UMb:BcON+zluZc1t9w

Score

10^/10

metasploit backdoor persistence trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Executes dropped EXE 2 IoCs

pid	Process
1784	csrss.exe
1068	csrss.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	67ca6587860f9d0df59e660eb21891dda49368ee004705c25b8dc613ea9fa37b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Registry Service = "csrss.exe"	67ca6587860f9d0df59e660eb21891dda49368ee004705c25b8dc613ea9fa37b.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1608 set thread context of 1984	1608	67ca6587860f9d0df59e660eb21891dda49368ee004705c25b8dc613ea9fa37b.exe	26
PID 1784 set thread context of 1068	1784	csrss.exe	28

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\csrss.exe	67ca6587860f9d0df59e660eb21891dda49368ee004705c25b8dc613ea9fa37b.exe
File opened for modification	C:\Windows\csrss.exe	67ca6587860f9d0df59e660eb21891dda49368ee004705c25b8dc613ea9fa37b.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1608	67ca6587860f9d0df59e660eb21891dda49368ee004705c25b8dc613ea9fa37b.exe
1784	csrss.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 1984	1608	67ca6587860f9d0df59e660eb21891dda49368ee004705c25b8dc613ea9fa37b.exe	26
PID 1608 wrote to memory of 1984	1608	67ca6587860f9d0df59e660eb21891dda49368ee004705c25b8dc613ea9fa37b.exe	26
PID 1608 wrote to memory of 1984	1608	67ca6587860f9d0df59e660eb21891dda49368ee004705c25b8dc613ea9fa37b.exe	26
PID 1608 wrote to memory of 1984	1608	67ca6587860f9d0df59e660eb21891dda49368ee004705c25b8dc613ea9fa37b.exe	26
PID 1608 wrote to memory of 1984	1608	67ca6587860f9d0df59e660eb21891dda49368ee004705c25b8dc613ea9fa37b.exe	26
PID 1608 wrote to memory of 1984	1608	67ca6587860f9d0df59e660eb21891dda49368ee004705c25b8dc613ea9fa37b.exe	26
PID 1608 wrote to memory of 1984	1608	67ca6587860f9d0df59e660eb21891dda49368ee004705c25b8dc613ea9fa37b.exe	26
PID 1608 wrote to memory of 1984	1608	67ca6587860f9d0df59e660eb21891dda49368ee004705c25b8dc613ea9fa37b.exe	26
PID 1608 wrote to memory of 1984	1608	67ca6587860f9d0df59e660eb21891dda49368ee004705c25b8dc613ea9fa37b.exe	26
PID 1984 wrote to memory of 1784	1984	67ca6587860f9d0df59e660eb21891dda49368ee004705c25b8dc613ea9fa37b.exe	27
PID 1984 wrote to memory of 1784	1984	67ca6587860f9d0df59e660eb21891dda49368ee004705c25b8dc613ea9fa37b.exe	27
PID 1984 wrote to memory of 1784	1984	67ca6587860f9d0df59e660eb21891dda49368ee004705c25b8dc613ea9fa37b.exe	27
PID 1984 wrote to memory of 1784	1984	67ca6587860f9d0df59e660eb21891dda49368ee004705c25b8dc613ea9fa37b.exe	27
PID 1784 wrote to memory of 1068	1784	csrss.exe	28
PID 1784 wrote to memory of 1068	1784	csrss.exe	28
PID 1784 wrote to memory of 1068	1784	csrss.exe	28
PID 1784 wrote to memory of 1068	1784	csrss.exe	28
PID 1784 wrote to memory of 1068	1784	csrss.exe	28
PID 1784 wrote to memory of 1068	1784	csrss.exe	28
PID 1784 wrote to memory of 1068	1784	csrss.exe	28
PID 1784 wrote to memory of 1068	1784	csrss.exe	28
PID 1784 wrote to memory of 1068	1784	csrss.exe	28

C:\Users\Admin\AppData\Local\Temp\67ca6587860f9d0df59e660eb21891dda49368ee004705c25b8dc613ea9fa37b.exe
"C:\Users\Admin\AppData\Local\Temp\67ca6587860f9d0df59e660eb21891dda49368ee004705c25b8dc613ea9fa37b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Users\Admin\AppData\Local\Temp\67ca6587860f9d0df59e660eb21891dda49368ee004705c25b8dc613ea9fa37b.exe
  "C:\Users\Admin\AppData\Local\Temp\67ca6587860f9d0df59e660eb21891dda49368ee004705c25b8dc613ea9fa37b.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\csrss.exe
    "C:\Windows\csrss.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1784
  - - C:\Windows\csrss.exe
      "C:\Windows\csrss.exe"
      4⤵
      Executes dropped EXE
      PID:1068

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\csrss.exe

Filesize
204KB

MD5
e0645978c758b3a5b4d96a5a0a37ff64

SHA1
9564de281369f4d8bc9253596bb7c15f3f970cc4

SHA256
67ca6587860f9d0df59e660eb21891dda49368ee004705c25b8dc613ea9fa37b

SHA512
7473eb01a90b739c7ffb94bd32dd77531daf19688086ca82416a41921e119369c4df2e6599033c9ecbaf346bfbd0ac5a3d1d35be993d3183e18bb0071b2ee9fc

Download Submit
C:\Windows\csrss.exe

Filesize
204KB

MD5
e0645978c758b3a5b4d96a5a0a37ff64

SHA1
9564de281369f4d8bc9253596bb7c15f3f970cc4

SHA256
67ca6587860f9d0df59e660eb21891dda49368ee004705c25b8dc613ea9fa37b

SHA512
7473eb01a90b739c7ffb94bd32dd77531daf19688086ca82416a41921e119369c4df2e6599033c9ecbaf346bfbd0ac5a3d1d35be993d3183e18bb0071b2ee9fc

Download Submit
C:\Windows\csrss.exe

Filesize
204KB

MD5
e0645978c758b3a5b4d96a5a0a37ff64

SHA1
9564de281369f4d8bc9253596bb7c15f3f970cc4

SHA256
67ca6587860f9d0df59e660eb21891dda49368ee004705c25b8dc613ea9fa37b

SHA512
7473eb01a90b739c7ffb94bd32dd77531daf19688086ca82416a41921e119369c4df2e6599033c9ecbaf346bfbd0ac5a3d1d35be993d3183e18bb0071b2ee9fc

Download Submit
memory/1068-91-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1068-90-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1068-88-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1984-68-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download
memory/1984-57-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1984-67-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1984-73-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1984-74-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1984-64-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1984-62-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1984-60-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1984-56-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1984-59-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download

Analysis

Sharing