metasploit | fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020

General

Target

fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
Size

227KB
MD5

1926d5d9eb5e4354f18083916de108f0
SHA1

f54ca406b5d189b19bdd2124c71660b921945cdb
SHA256

fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020
SHA512

32a58a5d68ac70f719f4fb86ed198171ae70c0f34e3d5b623722de7e407ed66caf2d19d37deb3d1590063f5bb1ae2911e4226739f0a33f9e5714479c8e7e3ae5
SSDEEP

3072:mq6zDsoY9iUeCRvRpR5RhD/HzkfVtLrNFSDg6w3x5VdO3huCFOnYit8aQ:mqKC9X/L/cVtLxthdGhvOf

Score

10^/10

metasploit backdoor evasion persistence trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Modifies firewall policy service 2 TTPs 10 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

reg.exereg.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\sysdiag64.exe = "C:\\Windows\\sysdiag64.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe:*:Enabled:Windows Messanger"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\MicrosoftCorp = "C:\\Windows\\sysdiag64.exe"	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe

Executes dropped EXE 2 IoCs

Processes:

sysdiag64.exesysdiag64.exe

pid process

2888 sysdiag64.exe
260 sysdiag64.exe

pid	process
2888	sysdiag64.exe
260	sysdiag64.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicrosoftNAPC = "C:\\Windows\\sysdiag64.exe"	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysdiag64.exe = "C:\\Windows\\sysdiag64.exe"	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exesysdiag64.exe

description	pid	process	target process
PID 4056 set thread context of 4924	4056	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
PID 2888 set thread context of 260	2888	sysdiag64.exe	sysdiag64.exe

Drops file in Windows directory 4 IoCs

Processes:

fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exesysdiag64.exe

description	ioc	process
File created	C:\Windows\sysdiag64.exe	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
File opened for modification	C:\Windows\sysdiag64.exe	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
File opened for modification	C:\Windows\sysdiag64.exe	sysdiag64.exe
File created	C:\Windows\sysdiag64.exe	sysdiag64.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exereg.exe

pid process

1420 reg.exe
2796 reg.exe
2988 reg.exe
3140 reg.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exesysdiag64.exe

pid process

4056 fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
2888 sysdiag64.exe

pid	process
1420	reg.exe
2796	reg.exe
2988	reg.exe
3140	reg.exe

pid	process
4056	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
2888	sysdiag64.exe

Suspicious use of WriteProcessMemory 47 IoCs

Processes:

fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.execmd.execmd.exefdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exesysdiag64.execmd.execmd.exe

description	pid	process	target process
PID 4056 wrote to memory of 5112	4056	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	cmd.exe
PID 4056 wrote to memory of 5112	4056	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	cmd.exe
PID 4056 wrote to memory of 5112	4056	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	cmd.exe
PID 4056 wrote to memory of 1240	4056	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	cmd.exe
PID 4056 wrote to memory of 1240	4056	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	cmd.exe
PID 4056 wrote to memory of 1240	4056	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	cmd.exe
PID 4056 wrote to memory of 4924	4056	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
PID 4056 wrote to memory of 4924	4056	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
PID 4056 wrote to memory of 4924	4056	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
PID 4056 wrote to memory of 4924	4056	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
PID 4056 wrote to memory of 4924	4056	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
PID 4056 wrote to memory of 4924	4056	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
PID 4056 wrote to memory of 4924	4056	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
PID 4056 wrote to memory of 4924	4056	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
PID 4056 wrote to memory of 4924	4056	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
PID 4056 wrote to memory of 4924	4056	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
PID 5112 wrote to memory of 2796	5112	cmd.exe	reg.exe
PID 5112 wrote to memory of 2796	5112	cmd.exe	reg.exe
PID 5112 wrote to memory of 2796	5112	cmd.exe	reg.exe
PID 1240 wrote to memory of 1420	1240	cmd.exe	reg.exe
PID 1240 wrote to memory of 1420	1240	cmd.exe	reg.exe
PID 1240 wrote to memory of 1420	1240	cmd.exe	reg.exe
PID 4924 wrote to memory of 2888	4924	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	sysdiag64.exe
PID 4924 wrote to memory of 2888	4924	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	sysdiag64.exe
PID 4924 wrote to memory of 2888	4924	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	sysdiag64.exe
PID 2888 wrote to memory of 4836	2888	sysdiag64.exe	cmd.exe
PID 2888 wrote to memory of 4836	2888	sysdiag64.exe	cmd.exe
PID 2888 wrote to memory of 4836	2888	sysdiag64.exe	cmd.exe
PID 2888 wrote to memory of 4448	2888	sysdiag64.exe	cmd.exe
PID 2888 wrote to memory of 4448	2888	sysdiag64.exe	cmd.exe
PID 2888 wrote to memory of 4448	2888	sysdiag64.exe	cmd.exe
PID 2888 wrote to memory of 260	2888	sysdiag64.exe	sysdiag64.exe
PID 2888 wrote to memory of 260	2888	sysdiag64.exe	sysdiag64.exe
PID 2888 wrote to memory of 260	2888	sysdiag64.exe	sysdiag64.exe
PID 2888 wrote to memory of 260	2888	sysdiag64.exe	sysdiag64.exe
PID 2888 wrote to memory of 260	2888	sysdiag64.exe	sysdiag64.exe
PID 2888 wrote to memory of 260	2888	sysdiag64.exe	sysdiag64.exe
PID 2888 wrote to memory of 260	2888	sysdiag64.exe	sysdiag64.exe
PID 2888 wrote to memory of 260	2888	sysdiag64.exe	sysdiag64.exe
PID 2888 wrote to memory of 260	2888	sysdiag64.exe	sysdiag64.exe
PID 2888 wrote to memory of 260	2888	sysdiag64.exe	sysdiag64.exe
PID 4836 wrote to memory of 2988	4836	cmd.exe	reg.exe
PID 4836 wrote to memory of 2988	4836	cmd.exe	reg.exe
PID 4836 wrote to memory of 2988	4836	cmd.exe	reg.exe
PID 4448 wrote to memory of 3140	4448	cmd.exe	reg.exe
PID 4448 wrote to memory of 3140	4448	cmd.exe	reg.exe
PID 4448 wrote to memory of 3140	4448	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
"C:\Users\Admin\AppData\Local\Temp\fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4056

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:5112

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
3⤵
- Modifies firewall policy service
- Modifies registry key
PID:2796

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe:*:Enabled:Windows Messanger" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:1240

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe:*:Enabled:Windows Messanger" /f
3⤵
- Modifies firewall policy service
- Modifies registry key
PID:1420

C:\Users\Admin\AppData\Local\Temp\fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
"C:\Users\Admin\AppData\Local\Temp\fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe"
2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4924

C:\Windows\sysdiag64.exe
"C:\Windows\sysdiag64.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
4⤵
- Suspicious use of WriteProcessMemory
PID:4836

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
5⤵
- Modifies firewall policy service
- Modifies registry key
PID:2988

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\sysdiag64.exe" /t REG_SZ /d "C:\Windows\sysdiag64.exe:*:Enabled:Windows Messanger" /f
4⤵
- Suspicious use of WriteProcessMemory
PID:4448

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\sysdiag64.exe" /t REG_SZ /d "C:\Windows\sysdiag64.exe:*:Enabled:Windows Messanger" /f
5⤵
- Modifies firewall policy service
- Modifies registry key
PID:3140

C:\Windows\sysdiag64.exe
"C:\Windows\sysdiag64.exe"
4⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:260

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

4

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\sysdiag64.exe
Filesize
227KB

MD5
1926d5d9eb5e4354f18083916de108f0

SHA1
f54ca406b5d189b19bdd2124c71660b921945cdb

SHA256
fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020

SHA512
32a58a5d68ac70f719f4fb86ed198171ae70c0f34e3d5b623722de7e407ed66caf2d19d37deb3d1590063f5bb1ae2911e4226739f0a33f9e5714479c8e7e3ae5

Download Submit
C:\Windows\sysdiag64.exe
Filesize
227KB

MD5
1926d5d9eb5e4354f18083916de108f0

SHA1
f54ca406b5d189b19bdd2124c71660b921945cdb

SHA256
fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020

SHA512
32a58a5d68ac70f719f4fb86ed198171ae70c0f34e3d5b623722de7e407ed66caf2d19d37deb3d1590063f5bb1ae2911e4226739f0a33f9e5714479c8e7e3ae5

Download Submit
C:\Windows\sysdiag64.exe
Filesize
227KB

MD5
1926d5d9eb5e4354f18083916de108f0

SHA1
f54ca406b5d189b19bdd2124c71660b921945cdb

SHA256
fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020

SHA512
32a58a5d68ac70f719f4fb86ed198171ae70c0f34e3d5b623722de7e407ed66caf2d19d37deb3d1590063f5bb1ae2911e4226739f0a33f9e5714479c8e7e3ae5

Download Submit
memory/260-161-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/260-152-0x0000000000000000-mapping.dmp

Download
memory/1240-136-0x0000000000000000-mapping.dmp

Download
memory/1420-143-0x0000000000000000-mapping.dmp

Download
memory/2796-142-0x0000000000000000-mapping.dmp

Download
memory/2888-158-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2888-145-0x0000000000000000-mapping.dmp

Download
memory/2988-157-0x0000000000000000-mapping.dmp

Download
memory/3140-160-0x0000000000000000-mapping.dmp

Download
memory/4056-141-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4056-134-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4448-151-0x0000000000000000-mapping.dmp

Download
memory/4836-150-0x0000000000000000-mapping.dmp

Download
memory/4924-144-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/4924-140-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/4924-138-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/4924-159-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/4924-137-0x0000000000000000-mapping.dmp

Download
memory/5112-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads