metasploit | 985f82e71e6781286468c4e8f576009fa3bfdd30facdbc638ec49725da93430b

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
30/06/2023, 12:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jbHmvbzS.ps1
Size 3KB
Sample230630-panv1aab72
SHA256 985f82e71e6781286468c4e8f576009fa3bfdd30facdbc638ec49725da93430b
MD5 5274758378f9fc7ec1f11dc97fa86768
SHA1 cfa2566b2bf1824dcc57d98505ba6929714fa42c
SHA512 8a391437f015c072023c03e6e9017ae11fa6e8438be90aaf5c419a734dd34061753209acd018669eb13755cb97bfe44f3188b6366394c854cac9e573ad548cb4
MD5 SHA1 SHA512

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

metasploit_stager

3.22.53.161:14524

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Blocklisted process makes network request 1 IoCs

flow	pid	Process
6	5044	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5044	powershell.exe
5044	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5044	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 4260	5044	powershell.exe	82
PID 5044 wrote to memory of 4260	5044	powershell.exe	82
PID 4260 wrote to memory of 2040	4260	csc.exe	83
PID 4260 wrote to memory of 2040	4260	csc.exe	83

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\jbHmvbzS.ps1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lfsjdynw\lfsjdynw.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6BAF.tmp" "c:\Users\Admin\AppData\Local\Temp\lfsjdynw\CSCFBEAE2BD624645DBA3F0725CC2BA4D0.TMP"
    3⤵
    PID:2040

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:4576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

RES6BAF.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6BAF.tmp
Size 1KB
SHA256 438ccb9c598f676221c6d406e84154a35f154e5c2aa181820e9a09d0c05b8cf8
MD5 6abaeb9da08d9bd1d63edad94d23ec7b
SHA1 fe72d77796b10ad93e44a11f4694821421e7ac51
SHA512 6b1a8e2920de2165b8b4d77a308f8cd7d3eaec1241df5062322a66eb23f3157327f1e247028fa38566dc51c623ac3309673494f49a2c1dc62f468d080e7ace64
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_3gqxomme.cbx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3gqxomme.cbx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

lfsjdynw.dll

Path C:\Users\Admin\AppData\Local\Temp\lfsjdynw\lfsjdynw.dll
Size 3KB
SHA256 68e0b977c2ebbdfc7a5cc7b50e34f1b979d8a3225e9d4321fd5c8bfe67850da4
MD5 15960cec3b41da8ef72f7a15813f146a
SHA1 0843031e3782ea792962fe928047bf84e935793e
SHA512 1c89a056f66f952bd76fbee94ad19dcc23f17032483684f4e6c6942355cf3f2547fa0d37530ff39e7bf1488262ab5d328b23650c5a519976b7e568848892eeba
MD5 SHA1 SHA512

Submit Download

CSCFBEAE2BD624645DBA3F0725CC2BA4D0.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\lfsjdynw\CSCFBEAE2BD624645DBA3F0725CC2BA4D0.TMP
Size 652B
SHA256 f84a3ac64988916bf079234a6fe37977649676e7dc24d2d3aa6d20b2bd988bb0
MD5 9a07e4fb1d59ccdc7a366cd401d578a8
SHA1 21c92a08a1557b7bafb03bb51dbb5b7ba78d6bf0
SHA512 c740586135b0f572f59765d1b4b25c9cd8235df6d214da886a45c7bf807863f4009d4156ee8f88643ea1ebc7a81fd3ce3e445ac0757fa98b813cee6ea7ba0b2f
MD5 SHA1 SHA512

Submit Download

lfsjdynw.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\lfsjdynw\lfsjdynw.0.cs
Size 468B
SHA256 5a67bcd5871f71a78abf1da47c3529617f34b47a5ab7bde0f1133a33fa751012
MD5 52cc39367c8ed123b15e831e52cbd25f
SHA1 497593af41731aedd939d2234d8d117c57a6d726
SHA512 ce6b89a38b94543b6461b5ecc01054c518a6e0daa4962e249a694db198b15602e716098868322eb8275a09d936b4ef3c0242089800bac0ab1926c8bb38d78fcc
MD5 SHA1 SHA512

Submit Download

lfsjdynw.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\lfsjdynw\lfsjdynw.cmdline
Size 369B
SHA256 6cddf5633c8ddb06501c1e7434ce0f3d18f96f390f86b9956147c69d7414eab9
MD5 e5e3cd40776f2c07b6039015ff655979
SHA1 b730b0819d90260c0976a00f0670e4b528f6bff8
SHA512 7f166c943e12dd43e1dcbce60e455c7049d416eb45142e4c4960e472aac6c71cb747b191519516ced8d875a4fe4a97d53d9fa4911c9819bb8389b9e293a99025
MD5 SHA1 SHA512

Submit Download

memory/5044-138-0x0000024B43C90000-0x0000024B43CB2000-memory.dmp

Download

memory/5044-143-0x0000024B41C10000-0x0000024B41C20000-memory.dmp

Download

memory/5044-144-0x0000024B41C10000-0x0000024B41C20000-memory.dmp

Download

memory/5044-145-0x0000024B41C10000-0x0000024B41C20000-memory.dmp

Download

memory/5044-159-0x0000024B43CE0000-0x0000024B43CE1000-memory.dmp

Download