General

  • Target

    dfef17deee08ed6bc8405d0da7b46263ab88a77580a48efaf11bc317bbd9e174

  • Size

    224KB

  • Sample

    221204-nr82tsad2w

  • MD5

    3afe6fa198d0191ad4470a79126f333e

  • SHA1

    959b9639f05989dfef918070c0bb4aef34047e92

  • SHA256

    dfef17deee08ed6bc8405d0da7b46263ab88a77580a48efaf11bc317bbd9e174

  • SHA512

    f9eb3320d19681f7e728100e1209995210696f5eb28c5c240efcde90ca8788f8b487dcfe4df7310a2d892e79658d5ddfc8262e95ef67ee9a33a9dccd48a5692d

  • SSDEEP

    3072:OyyL6e5KJOUM8GXLimIxlLUQtVWSjFLrjF0TSUSj74JgO0GgGsgWAWUsN4dtv:OrWe8oiGiBrFLXF0mA70GWZU9tv

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

    • Target

      dfef17deee08ed6bc8405d0da7b46263ab88a77580a48efaf11bc317bbd9e174

    • Size

      224KB

    • MD5

      3afe6fa198d0191ad4470a79126f333e

    • SHA1

      959b9639f05989dfef918070c0bb4aef34047e92

    • SHA256

      dfef17deee08ed6bc8405d0da7b46263ab88a77580a48efaf11bc317bbd9e174

    • SHA512

      f9eb3320d19681f7e728100e1209995210696f5eb28c5c240efcde90ca8788f8b487dcfe4df7310a2d892e79658d5ddfc8262e95ef67ee9a33a9dccd48a5692d

    • SSDEEP

      3072:OyyL6e5KJOUM8GXLimIxlLUQtVWSjFLrjF0TSUSj74JgO0GgGsgWAWUsN4dtv:OrWe8oiGiBrFLXF0mA70GWZU9tv

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Modifies firewall policy service

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

2
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Tasks