metasploit | f3c45923d187a02ffac9469f65edcace142b0cefc85e9bd536900ea74a32e9e8

General

Target

f3c45923d187a02ffac9469f65edcace142b0cefc85e9bd536900ea74a32e9e8.exe
Size

52KB
MD5

1fdd45c21dc7cf497867091f245e4a98
SHA1

98aa747bd12826b61272347b50c6af40ed9e0f4c
SHA256

f3c45923d187a02ffac9469f65edcace142b0cefc85e9bd536900ea74a32e9e8
SHA512

fcae80f6da193bfa533762708c6a1614c9b101050edcee9ff5ea39505e00aab954a283fd04d8068994d288e8086bfa1e8b108f4a3eb27694b6fe5d9c40d43e99
SSDEEP

768:RKMBElKgOTqFQ98bPQ0Q+nFLNvrZ+VafZr1vXX4JEmVuRQBDYIsz8X79T3v8PXIF:RuO+aSa0p1+UBdgQQB8J8X7hSYg2C8

Score

10^/10

metasploit backdoor persistence trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	f3c45923d187a02ffac9469f65edcace142b0cefc85e9bd536900ea74a32e9e8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft Driver Setup = "C:\\Windows\\aadrive32.exe"	f3c45923d187a02ffac9469f65edcace142b0cefc85e9bd536900ea74a32e9e8.exe

Executes dropped EXE 2 IoCs

pid	Process
1392	aadrive32.exe
960	aadrive32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	f3c45923d187a02ffac9469f65edcace142b0cefc85e9bd536900ea74a32e9e8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Driver Setup = "C:\\Windows\\aadrive32.exe"	f3c45923d187a02ffac9469f65edcace142b0cefc85e9bd536900ea74a32e9e8.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 368 set thread context of 1556	368	f3c45923d187a02ffac9469f65edcace142b0cefc85e9bd536900ea74a32e9e8.exe	27
PID 1392 set thread context of 960	1392	aadrive32.exe	29

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\aadrive32.exe	f3c45923d187a02ffac9469f65edcace142b0cefc85e9bd536900ea74a32e9e8.exe
File opened for modification	C:\Windows\aadrive32.exe	f3c45923d187a02ffac9469f65edcace142b0cefc85e9bd536900ea74a32e9e8.exe
File created	C:\Windows\%windir%\lfffile32.log	aadrive32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1556	f3c45923d187a02ffac9469f65edcace142b0cefc85e9bd536900ea74a32e9e8.exe
1556	f3c45923d187a02ffac9469f65edcace142b0cefc85e9bd536900ea74a32e9e8.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 1556	368	f3c45923d187a02ffac9469f65edcace142b0cefc85e9bd536900ea74a32e9e8.exe	27
PID 368 wrote to memory of 1556	368	f3c45923d187a02ffac9469f65edcace142b0cefc85e9bd536900ea74a32e9e8.exe	27
PID 368 wrote to memory of 1556	368	f3c45923d187a02ffac9469f65edcace142b0cefc85e9bd536900ea74a32e9e8.exe	27
PID 368 wrote to memory of 1556	368	f3c45923d187a02ffac9469f65edcace142b0cefc85e9bd536900ea74a32e9e8.exe	27
PID 368 wrote to memory of 1556	368	f3c45923d187a02ffac9469f65edcace142b0cefc85e9bd536900ea74a32e9e8.exe	27
PID 368 wrote to memory of 1556	368	f3c45923d187a02ffac9469f65edcace142b0cefc85e9bd536900ea74a32e9e8.exe	27
PID 368 wrote to memory of 1556	368	f3c45923d187a02ffac9469f65edcace142b0cefc85e9bd536900ea74a32e9e8.exe	27
PID 368 wrote to memory of 1556	368	f3c45923d187a02ffac9469f65edcace142b0cefc85e9bd536900ea74a32e9e8.exe	27
PID 1556 wrote to memory of 1392	1556	f3c45923d187a02ffac9469f65edcace142b0cefc85e9bd536900ea74a32e9e8.exe	28
PID 1556 wrote to memory of 1392	1556	f3c45923d187a02ffac9469f65edcace142b0cefc85e9bd536900ea74a32e9e8.exe	28
PID 1556 wrote to memory of 1392	1556	f3c45923d187a02ffac9469f65edcace142b0cefc85e9bd536900ea74a32e9e8.exe	28
PID 1556 wrote to memory of 1392	1556	f3c45923d187a02ffac9469f65edcace142b0cefc85e9bd536900ea74a32e9e8.exe	28
PID 1392 wrote to memory of 960	1392	aadrive32.exe	29
PID 1392 wrote to memory of 960	1392	aadrive32.exe	29
PID 1392 wrote to memory of 960	1392	aadrive32.exe	29
PID 1392 wrote to memory of 960	1392	aadrive32.exe	29
PID 1392 wrote to memory of 960	1392	aadrive32.exe	29
PID 1392 wrote to memory of 960	1392	aadrive32.exe	29
PID 1392 wrote to memory of 960	1392	aadrive32.exe	29
PID 1392 wrote to memory of 960	1392	aadrive32.exe	29

C:\Users\Admin\AppData\Local\Temp\f3c45923d187a02ffac9469f65edcace142b0cefc85e9bd536900ea74a32e9e8.exe
"C:\Users\Admin\AppData\Local\Temp\f3c45923d187a02ffac9469f65edcace142b0cefc85e9bd536900ea74a32e9e8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:368
- C:\Users\Admin\AppData\Local\Temp\f3c45923d187a02ffac9469f65edcace142b0cefc85e9bd536900ea74a32e9e8.exe
  "C:\Users\Admin\AppData\Local\Temp\f3c45923d187a02ffac9469f65edcace142b0cefc85e9bd536900ea74a32e9e8.exe"
  2⤵
  - Adds policy Run key to start application
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1556
- - C:\Windows\aadrive32.exe
    "C:\Windows\aadrive32.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1392
  - - C:\Windows\aadrive32.exe
      "C:\Windows\aadrive32.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\aadrive32.exe

Filesize
52KB

MD5
1fdd45c21dc7cf497867091f245e4a98

SHA1
98aa747bd12826b61272347b50c6af40ed9e0f4c

SHA256
f3c45923d187a02ffac9469f65edcace142b0cefc85e9bd536900ea74a32e9e8

SHA512
fcae80f6da193bfa533762708c6a1614c9b101050edcee9ff5ea39505e00aab954a283fd04d8068994d288e8086bfa1e8b108f4a3eb27694b6fe5d9c40d43e99

Download Submit
C:\Windows\aadrive32.exe

Filesize
52KB

MD5
1fdd45c21dc7cf497867091f245e4a98

SHA1
98aa747bd12826b61272347b50c6af40ed9e0f4c

SHA256
f3c45923d187a02ffac9469f65edcace142b0cefc85e9bd536900ea74a32e9e8

SHA512
fcae80f6da193bfa533762708c6a1614c9b101050edcee9ff5ea39505e00aab954a283fd04d8068994d288e8086bfa1e8b108f4a3eb27694b6fe5d9c40d43e99

Download Submit
C:\Windows\aadrive32.exe

Filesize
52KB

MD5
1fdd45c21dc7cf497867091f245e4a98

SHA1
98aa747bd12826b61272347b50c6af40ed9e0f4c

SHA256
f3c45923d187a02ffac9469f65edcace142b0cefc85e9bd536900ea74a32e9e8

SHA512
fcae80f6da193bfa533762708c6a1614c9b101050edcee9ff5ea39505e00aab954a283fd04d8068994d288e8086bfa1e8b108f4a3eb27694b6fe5d9c40d43e99

Download Submit
memory/368-63-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/960-86-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/960-85-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1392-79-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1556-65-0x0000000074AD1000-0x0000000074AD3000-memory.dmp

Filesize
8KB

Download
memory/1556-58-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1556-57-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1556-60-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1556-64-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1556-55-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1556-82-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1556-83-0x00000000004E0000-0x00000000004F1000-memory.dmp

Filesize
68KB

Download
memory/1556-84-0x00000000004E0000-0x00000000004F1000-memory.dmp

Filesize
68KB

Download
memory/1556-54-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads