General

  • Target

    c78a9fe193a5240db70347db2d706f7220cb6c44bdfe93963a913017bae2a068

  • Size

    264KB

  • Sample

    221203-fxkmesge36

  • MD5

    4a98d7b922e2f2f1311691fd72ac6165

  • SHA1

    b8908da5939129a18c74c6e3cdf84173d82cb976

  • SHA256

    c78a9fe193a5240db70347db2d706f7220cb6c44bdfe93963a913017bae2a068

  • SHA512

    31c807071057ec5108f49f07f9c2b1fbad6cd8e2b037d73a512fc7a5e726459f04c6d3021856e8ea09fa322aa90f43a638367c9cae300c87f7874dd1d633dcd9

  • SSDEEP

    6144:gxmbk8IpdzdmGnmAKta4p8uMqR1q/tKu31q/t:gxmbk9pmKUtaK8uMeIYII

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

    • Target

      c78a9fe193a5240db70347db2d706f7220cb6c44bdfe93963a913017bae2a068

    • Size

      264KB

    • MD5

      4a98d7b922e2f2f1311691fd72ac6165

    • SHA1

      b8908da5939129a18c74c6e3cdf84173d82cb976

    • SHA256

      c78a9fe193a5240db70347db2d706f7220cb6c44bdfe93963a913017bae2a068

    • SHA512

      31c807071057ec5108f49f07f9c2b1fbad6cd8e2b037d73a512fc7a5e726459f04c6d3021856e8ea09fa322aa90f43a638367c9cae300c87f7874dd1d633dcd9

    • SSDEEP

      6144:gxmbk8IpdzdmGnmAKta4p8uMqR1q/tKu31q/t:gxmbk9pmKUtaK8uMeIYII

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Modifies firewall policy service

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

2
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Tasks