metasploit | 6e828d82cc43dbfbcebc72c6bfa079cbf6da3c3f7fd917d6ba257bda0b011d82

Analysis

max time kernel
15s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 03:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4a5627024710f08bc8f62033e6414221.exe
Size 412KB
Sample240108-d61znabea7
SHA256 6e828d82cc43dbfbcebc72c6bfa079cbf6da3c3f7fd917d6ba257bda0b011d82
MD5 4a5627024710f08bc8f62033e6414221
SHA1 7c4085557816e40c0a95949e093562460e7f8652
SHA512 1e329f5460f9e8249d93425ce4218454c5e3b625200c41474cb7f85e5561c0784ee5d490a25bc73510d6ef510ddda74c209f75c0958c24e8f8499c1ad572386e
SSDEEP 6144:uwdlYcZu3veqrqAcRijtpIYvolrl9g+ymzOLPrnOKIgkKUM/CoFGR34eTmu0:uTvFRpIDvv1CTLOLvqCgCj6d
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Executes dropped EXE 4 IoCs

pid	Process
2128	peterrr.exe
4484	peterrr.exe
4208	peterrr.exe
3556	peterrr.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\peterrr.exe	4a5627024710f08bc8f62033e6414221.exe
File opened for modification	C:\Windows\SysWOW64\peterrr.exe	4a5627024710f08bc8f62033e6414221.exe
File opened for modification	C:\Windows\SysWOW64\peterrr.exe	peterrr.exe
File created	C:\Windows\SysWOW64\peterrr.exe	peterrr.exe
File opened for modification	C:\Windows\SysWOW64\peterrr.exe	peterrr.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1228 set thread context of 2888	1228	4a5627024710f08bc8f62033e6414221.exe	23
PID 2128 set thread context of 4484	2128	peterrr.exe	21
PID 4208 set thread context of 3556	4208	peterrr.exe	100

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 2888	1228	4a5627024710f08bc8f62033e6414221.exe	23
PID 1228 wrote to memory of 2888	1228	4a5627024710f08bc8f62033e6414221.exe	23
PID 1228 wrote to memory of 2888	1228	4a5627024710f08bc8f62033e6414221.exe	23
PID 1228 wrote to memory of 2888	1228	4a5627024710f08bc8f62033e6414221.exe	23
PID 1228 wrote to memory of 2888	1228	4a5627024710f08bc8f62033e6414221.exe	23
PID 2888 wrote to memory of 2128	2888	4a5627024710f08bc8f62033e6414221.exe	22
PID 2888 wrote to memory of 2128	2888	4a5627024710f08bc8f62033e6414221.exe	22
PID 2888 wrote to memory of 2128	2888	4a5627024710f08bc8f62033e6414221.exe	22
PID 2128 wrote to memory of 4484	2128	peterrr.exe	21
PID 2128 wrote to memory of 4484	2128	peterrr.exe	21
PID 2128 wrote to memory of 4484	2128	peterrr.exe	21
PID 2128 wrote to memory of 4484	2128	peterrr.exe	21
PID 2128 wrote to memory of 4484	2128	peterrr.exe	21
PID 4484 wrote to memory of 4208	4484	peterrr.exe	101
PID 4484 wrote to memory of 4208	4484	peterrr.exe	101
PID 4484 wrote to memory of 4208	4484	peterrr.exe	101
PID 4208 wrote to memory of 3556	4208	peterrr.exe	100
PID 4208 wrote to memory of 3556	4208	peterrr.exe	100
PID 4208 wrote to memory of 3556	4208	peterrr.exe	100
PID 4208 wrote to memory of 3556	4208	peterrr.exe	100
PID 4208 wrote to memory of 3556	4208	peterrr.exe	100

C:\Users\Admin\AppData\Local\Temp\4a5627024710f08bc8f62033e6414221.exe
"C:\Users\Admin\AppData\Local\Temp\4a5627024710f08bc8f62033e6414221.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Users\Admin\AppData\Local\Temp\4a5627024710f08bc8f62033e6414221.exe
  C:\Users\Admin\AppData\Local\Temp\4a5627024710f08bc8f62033e6414221.exe
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2888

C:\Windows\SysWOW64\peterrr.exe
C:\Windows\SysWOW64\peterrr.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Windows\SysWOW64\peterrr.exe
  C:\Windows\system32\peterrr.exe 1148 "C:\Windows\SysWOW64\peterrr.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4208

C:\Windows\SysWOW64\peterrr.exe
C:\Windows\system32\peterrr.exe 1000 "C:\Users\Admin\AppData\Local\Temp\4a5627024710f08bc8f62033e6414221.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2128

C:\Windows\SysWOW64\peterrr.exe
C:\Windows\SysWOW64\peterrr.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3556
- C:\Windows\SysWOW64\peterrr.exe
  C:\Windows\system32\peterrr.exe 1116 "C:\Windows\SysWOW64\peterrr.exe"
  2⤵
  PID:528

C:\Windows\SysWOW64\peterrr.exe
C:\Windows\SysWOW64\peterrr.exe
1⤵
PID:3768
- C:\Windows\SysWOW64\peterrr.exe
  C:\Windows\system32\peterrr.exe 1124 "C:\Windows\SysWOW64\peterrr.exe"
  2⤵
  PID:5088

C:\Windows\SysWOW64\peterrr.exe
C:\Windows\SysWOW64\peterrr.exe
1⤵
PID:4952
- C:\Windows\SysWOW64\peterrr.exe
  C:\Windows\system32\peterrr.exe 1128 "C:\Windows\SysWOW64\peterrr.exe"
  2⤵
  PID:1644

C:\Windows\SysWOW64\peterrr.exe
C:\Windows\SysWOW64\peterrr.exe
1⤵
PID:2360
- C:\Windows\SysWOW64\peterrr.exe
  C:\Windows\system32\peterrr.exe 1116 "C:\Windows\SysWOW64\peterrr.exe"
  2⤵
  PID:1892

C:\Windows\SysWOW64\peterrr.exe
C:\Windows\SysWOW64\peterrr.exe
1⤵
PID:1916
- C:\Windows\SysWOW64\peterrr.exe
  C:\Windows\system32\peterrr.exe 1124 "C:\Windows\SysWOW64\peterrr.exe"
  2⤵
  PID:4324

C:\Windows\SysWOW64\peterrr.exe
C:\Windows\SysWOW64\peterrr.exe
1⤵
PID:1644
- C:\Windows\SysWOW64\peterrr.exe
  C:\Windows\system32\peterrr.exe 1124 "C:\Windows\SysWOW64\peterrr.exe"
  2⤵
  PID:4776

C:\Windows\SysWOW64\peterrr.exe
C:\Windows\SysWOW64\peterrr.exe
1⤵
PID:2488
- C:\Windows\SysWOW64\peterrr.exe
  C:\Windows\system32\peterrr.exe 1120 "C:\Windows\SysWOW64\peterrr.exe"
  2⤵
  PID:1756
- - C:\Windows\SysWOW64\peterrr.exe
    C:\Windows\SysWOW64\peterrr.exe
    3⤵
    PID:4044
  - - C:\Windows\SysWOW64\peterrr.exe
      C:\Windows\system32\peterrr.exe 1124 "C:\Windows\SysWOW64\peterrr.exe"
      4⤵
      PID:1252

C:\Windows\SysWOW64\peterrr.exe
C:\Windows\SysWOW64\peterrr.exe
1⤵
PID:1152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

peterrr.exe

Path C:\Windows\SysWOW64\peterrr.exe
Size 412KB
SHA256 6e828d82cc43dbfbcebc72c6bfa079cbf6da3c3f7fd917d6ba257bda0b011d82
MD5 4a5627024710f08bc8f62033e6414221
SHA1 7c4085557816e40c0a95949e093562460e7f8652
SHA512 1e329f5460f9e8249d93425ce4218454c5e3b625200c41474cb7f85e5561c0784ee5d490a25bc73510d6ef510ddda74c209f75c0958c24e8f8499c1ad572386e
SSDEEP 6144:uwdlYcZu3veqrqAcRijtpIYvolrl9g+ymzOLPrnOKIgkKUM/CoFGR34eTmu0:uTvFRpIDvv1CTLOLvqCgCj6d
MD5 SHA1 SHA512 SSDEEP

Submit Download

peterrr.exe

Path C:\Windows\SysWOW64\peterrr.exe
Size 65KB
SHA256 12ea2de061b9f1219608df8c74b5b5a6729ced44f4bc5c6c18522bbe30e8d975
MD5 9e43467435468c5b4957f5072203f3e1
SHA1 fe16706bee54f3223d8e88a20d350423834bf5bf
SHA512 0da2791e3fb1987fb2c11edb3d41ce41dfd38114fec51178bbd5efeb8c60daead9de88961473ad092931a75f5329996f63b435b49d72affd149741d9e87160d7
SSDEEP 1536:/qLAd02SoTOGDzfOOtfNYM3SOZDmbwhVb:i6Soywz5lYgPJNhd
MD5 SHA1 SHA512 SSDEEP

Submit Download

peterrr.exe

Path C:\Windows\SysWOW64\peterrr.exe
Size 381KB
SHA256 c55fcbe256162126035884aca6ec3896a1de628754c763fdf4751e3257c58099
MD5 22f0b922f0877e2adbd2f2c3cf29b1ab
SHA1 98b1fcc8a30b2a55b5dc0bce10357a9738c87fb9
SHA512 116a7342767e141efc0e590481eb3a32a3d4758fece125f525e01045fff334e5d1a5c2cae01d96c8c291b36f790ccca5c1183d31765dcb0c7aa3dedbca74d5d3
SSDEEP 6144:uwdlYcZu3veqrqAcRijtpIYvolrl9g+ymzOLPrnOKIgkKUM/CoFGR34eL:uTvFRpIDvv1CTLOLvqCgCjL
MD5 SHA1 SHA512 SSDEEP

Submit Download

peterrr.exe

Path C:\Windows\SysWOW64\peterrr.exe
Size 92KB
SHA256 953b458171f5bfee554dc7658b472d8004c2dc96f4327cea13663d146589e0a5
MD5 dafa8b1c54244c0fa39d3ceaee3a5b2a
SHA1 cba1917bc44642cde5e9ecf8235bb9ba6a71d991
SHA512 d4f5a6e9f28f5e5ad68ac58172ece19149d12187c9b1bcf246bd27d6387653b5ed6c4d2751a71fab384287632084fe7d26f1450d16eb0de6da9489b99b4d239c
SSDEEP 1536:/qLAd02SoTOGDzfOOtfNYM3SOZDmbwhVEL3fk/gVZOapFgzpyvexE:i6Soywz5lYgPJNhu2KZyVyveK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1152-94-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/1152-95-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/1152-93-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/1644-68-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/1644-66-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/1644-67-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/1644-71-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/1644-78-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/1916-62-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/1916-58-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/1916-59-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/1916-57-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/1916-69-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/2360-50-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/2360-49-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/2360-60-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/2360-53-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/2360-48-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/2488-75-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/2488-87-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/2488-77-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/2488-76-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/2488-80-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/2888-15-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/2888-2-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/2888-3-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/2888-1-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/2888-0-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/3556-33-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/3556-21-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/3556-22-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/3556-23-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/3556-26-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/3768-31-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/3768-32-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/3768-35-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/3768-30-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/3768-42-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/4044-84-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/4044-86-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/4044-96-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/4044-89-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/4044-85-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/4484-17-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/4484-14-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/4484-12-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/4484-24-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/4484-13-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/4952-39-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/4952-51-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/4952-40-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/4952-41-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/4952-44-0x0000000000400000-0x000000000053E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads