metasploit | 8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933

General

Target

8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe
Size

124KB
MD5

529fade9b912037e65c8765d35d4b066
SHA1

108edd33406cda07d8ee2a87df8d305159aa7a25
SHA256

8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933
SHA512

1d7d1e006786a31a10b77a2634a480e35815dc8d18d34a0d3230fefed671d7a0a5377668d71fb44cca2a69ab0a344125b865122052ba56d8a1e45431c0189c17
SSDEEP

1536:khqSYtGeGemOBKu9eL5/4weWWzmrn14z7/zstv9ScRIMU/wAGrw1e5aRLW2/:7eVwweWUmr1S7/zw1R/UYAx1GYWO

Score

10^/10

metasploit backdoor persistence trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft Driver Setup = "C:\\Windows\\aadrive32.exe"	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe

Executes dropped EXE 2 IoCs

Processes:

aadrive32.exeaadrive32.exe

pid process

1620 aadrive32.exe
1500 aadrive32.exe

pid	process
1620	aadrive32.exe
1500	aadrive32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Driver Setup = "C:\\Windows\\aadrive32.exe"	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exeaadrive32.exe

description	pid	process	target process
PID 1644 set thread context of 1948	1644	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe
PID 1620 set thread context of 1500	1620	aadrive32.exe	aadrive32.exe

Drops file in Windows directory 3 IoCs

Processes:

8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exeaadrive32.exe

description	ioc	process
File created	C:\Windows\aadrive32.exe	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe
File opened for modification	C:\Windows\aadrive32.exe	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe
File created	C:\Windows\%windir%\lfffile32.log	aadrive32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe

pid	process
1948	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe
1948	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exeaadrive32.exe

pid process

1644 8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe
1620 aadrive32.exe

pid	process
1644	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe
1620	aadrive32.exe

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exeaadrive32.exe

description	pid	process	target process
PID 1644 wrote to memory of 1948	1644	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe
PID 1644 wrote to memory of 1948	1644	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe
PID 1644 wrote to memory of 1948	1644	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe
PID 1644 wrote to memory of 1948	1644	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe
PID 1644 wrote to memory of 1948	1644	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe
PID 1644 wrote to memory of 1948	1644	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe
PID 1644 wrote to memory of 1948	1644	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe
PID 1644 wrote to memory of 1948	1644	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe
PID 1644 wrote to memory of 1948	1644	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe
PID 1644 wrote to memory of 1948	1644	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe
PID 1644 wrote to memory of 1948	1644	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe
PID 1644 wrote to memory of 1948	1644	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe
PID 1948 wrote to memory of 1620	1948	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe	aadrive32.exe
PID 1948 wrote to memory of 1620	1948	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe	aadrive32.exe
PID 1948 wrote to memory of 1620	1948	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe	aadrive32.exe
PID 1948 wrote to memory of 1620	1948	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe	aadrive32.exe
PID 1948 wrote to memory of 1620	1948	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe	aadrive32.exe
PID 1948 wrote to memory of 1620	1948	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe	aadrive32.exe
PID 1948 wrote to memory of 1620	1948	8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe	aadrive32.exe
PID 1620 wrote to memory of 1500	1620	aadrive32.exe	aadrive32.exe
PID 1620 wrote to memory of 1500	1620	aadrive32.exe	aadrive32.exe
PID 1620 wrote to memory of 1500	1620	aadrive32.exe	aadrive32.exe
PID 1620 wrote to memory of 1500	1620	aadrive32.exe	aadrive32.exe
PID 1620 wrote to memory of 1500	1620	aadrive32.exe	aadrive32.exe
PID 1620 wrote to memory of 1500	1620	aadrive32.exe	aadrive32.exe
PID 1620 wrote to memory of 1500	1620	aadrive32.exe	aadrive32.exe
PID 1620 wrote to memory of 1500	1620	aadrive32.exe	aadrive32.exe
PID 1620 wrote to memory of 1500	1620	aadrive32.exe	aadrive32.exe
PID 1620 wrote to memory of 1500	1620	aadrive32.exe	aadrive32.exe
PID 1620 wrote to memory of 1500	1620	aadrive32.exe	aadrive32.exe
PID 1620 wrote to memory of 1500	1620	aadrive32.exe	aadrive32.exe

C:\Users\Admin\AppData\Local\Temp\8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe
"C:\Users\Admin\AppData\Local\Temp\8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1644

C:\Users\Admin\AppData\Local\Temp\8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe
C:\Users\Admin\AppData\Local\Temp\8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933.exe
2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\aadrive32.exe
"C:\Windows\aadrive32.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\aadrive32.exe
C:\Windows\aadrive32.exe
4⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1500

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\aadrive32.exe
Filesize
124KB

MD5
529fade9b912037e65c8765d35d4b066

SHA1
108edd33406cda07d8ee2a87df8d305159aa7a25

SHA256
8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933

SHA512
1d7d1e006786a31a10b77a2634a480e35815dc8d18d34a0d3230fefed671d7a0a5377668d71fb44cca2a69ab0a344125b865122052ba56d8a1e45431c0189c17

Download Submit
C:\Windows\aadrive32.exe
Filesize
124KB

MD5
529fade9b912037e65c8765d35d4b066

SHA1
108edd33406cda07d8ee2a87df8d305159aa7a25

SHA256
8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933

SHA512
1d7d1e006786a31a10b77a2634a480e35815dc8d18d34a0d3230fefed671d7a0a5377668d71fb44cca2a69ab0a344125b865122052ba56d8a1e45431c0189c17

Download Submit
C:\Windows\aadrive32.exe
Filesize
124KB

MD5
529fade9b912037e65c8765d35d4b066

SHA1
108edd33406cda07d8ee2a87df8d305159aa7a25

SHA256
8e2740916af9e933ff2afe5ce158af4220798875e18c148fa2b96530af260933

SHA512
1d7d1e006786a31a10b77a2634a480e35815dc8d18d34a0d3230fefed671d7a0a5377668d71fb44cca2a69ab0a344125b865122052ba56d8a1e45431c0189c17

Download Submit
memory/1500-77-0x0000000000407650-mapping.dmp

Download
memory/1500-88-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1500-87-0x00000000003B0000-0x00000000003E5000-memory.dmp

Filesize
212KB

Download
memory/1500-84-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1500-85-0x00000000003B0000-0x00000000003E5000-memory.dmp

Filesize
212KB

Download
memory/1500-86-0x00000000003B0000-0x00000000003E5000-memory.dmp

Filesize
212KB

Download
memory/1620-67-0x0000000000000000-mapping.dmp

Download
memory/1620-83-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1620-73-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1644-66-0x00000000002B0000-0x00000000002BD000-memory.dmp

Filesize
52KB

Download
memory/1644-65-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1644-54-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download
memory/1644-58-0x00000000002B0000-0x00000000002E5000-memory.dmp

Filesize
212KB

Download
memory/1644-57-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1948-62-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1948-74-0x0000000000230000-0x0000000000265000-memory.dmp

Filesize
212KB

Download
memory/1948-72-0x00000000024D0000-0x0000000002505000-memory.dmp

Filesize
212KB

Download
memory/1948-71-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1948-60-0x0000000000407650-mapping.dmp

Download
memory/1948-59-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads