metasploit | f01ed8e6605e38c8c2b59873b5bb927cd9e861e6acc0d5d184757ae6097de137

Analysis

max time kernel
149s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
17/01/2024, 01:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
61691a314c2f3d3f825243d9560623cd.exe
Size 102KB
Sample240117-b2374sedgr
SHA256 f01ed8e6605e38c8c2b59873b5bb927cd9e861e6acc0d5d184757ae6097de137
MD5 61691a314c2f3d3f825243d9560623cd
SHA1 644889d387bff0fe25bd9bc2138841a9379f7344
SHA512 190fd4137108c9f328d3e5abdd709ae26715c921b46fa0f832737db60e606487b49e542c375c847afee0d4c97b5e5aa7e6d8ed2115e0ae469b61d17f1be9195b
SSDEEP 3072:Y3wsezUFc5qVUpxReh0BiU0YADxZo+oaHA+EokeYSNJB:YAsDczx0LJYADxa+oaH3keYS7B
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Executes dropped EXE 10 IoCs

pid	Process
2644	scvhots
2796	scvhots
3056	scvhots
1576	scvhots
2896	scvhots
1868	scvhots
2604	scvhots
1292	scvhots
2308	scvhots
1844	scvhots

Loads dropped DLL 20 IoCs

pid	Process
2416	61691a314c2f3d3f825243d9560623cd.exe
2416	61691a314c2f3d3f825243d9560623cd.exe
2644	scvhots
2644	scvhots
2796	scvhots
2796	scvhots
3056	scvhots
3056	scvhots
1576	scvhots
1576	scvhots
2896	scvhots
2896	scvhots
1868	scvhots
1868	scvhots
2604	scvhots
2604	scvhots
1292	scvhots
1292	scvhots
2308	scvhots
2308	scvhots

Drops file in System32 directory 22 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\scvhots	scvhots
File created	C:\Windows\SysWOW64\scvhots	scvhots
File opened for modification	C:\Windows\SysWOW64\scvhots	scvhots
File created	C:\Windows\SysWOW64\scvhots	scvhots
File opened for modification	C:\Windows\SysWOW64\scvhots	scvhots
File opened for modification	C:\Windows\SysWOW64\scvhots	scvhots
File created	C:\Windows\SysWOW64\scvhots	scvhots
File opened for modification	C:\Windows\SysWOW64\scvhots	scvhots
File created	C:\Windows\SysWOW64\scvhots	scvhots
File created	C:\Windows\SysWOW64\scvhots	scvhots
File opened for modification	C:\Windows\SysWOW64\scvhots	scvhots
File created	C:\Windows\SysWOW64\scvhots	61691a314c2f3d3f825243d9560623cd.exe
File opened for modification	C:\Windows\SysWOW64\scvhots	scvhots
File created	C:\Windows\SysWOW64\scvhots	scvhots
File opened for modification	C:\Windows\SysWOW64\scvhots	scvhots
File created	C:\Windows\SysWOW64\scvhots	scvhots
File opened for modification	C:\Windows\SysWOW64\scvhots	61691a314c2f3d3f825243d9560623cd.exe
File opened for modification	C:\Windows\SysWOW64\scvhots	scvhots
File created	C:\Windows\SysWOW64\scvhots	scvhots
File opened for modification	C:\Windows\SysWOW64\scvhots	scvhots
File opened for modification	C:\Windows\SysWOW64\scvhots	scvhots
File created	C:\Windows\SysWOW64\scvhots	scvhots

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2644	2416	61691a314c2f3d3f825243d9560623cd.exe	28
PID 2416 wrote to memory of 2644	2416	61691a314c2f3d3f825243d9560623cd.exe	28
PID 2416 wrote to memory of 2644	2416	61691a314c2f3d3f825243d9560623cd.exe	28
PID 2416 wrote to memory of 2644	2416	61691a314c2f3d3f825243d9560623cd.exe	28
PID 2644 wrote to memory of 2796	2644	scvhots	29
PID 2644 wrote to memory of 2796	2644	scvhots	29
PID 2644 wrote to memory of 2796	2644	scvhots	29
PID 2644 wrote to memory of 2796	2644	scvhots	29
PID 2796 wrote to memory of 3056	2796	scvhots	32
PID 2796 wrote to memory of 3056	2796	scvhots	32
PID 2796 wrote to memory of 3056	2796	scvhots	32
PID 2796 wrote to memory of 3056	2796	scvhots	32
PID 3056 wrote to memory of 1576	3056	scvhots	33
PID 3056 wrote to memory of 1576	3056	scvhots	33
PID 3056 wrote to memory of 1576	3056	scvhots	33
PID 3056 wrote to memory of 1576	3056	scvhots	33
PID 1576 wrote to memory of 2896	1576	scvhots	34
PID 1576 wrote to memory of 2896	1576	scvhots	34
PID 1576 wrote to memory of 2896	1576	scvhots	34
PID 1576 wrote to memory of 2896	1576	scvhots	34
PID 2896 wrote to memory of 1868	2896	scvhots	35
PID 2896 wrote to memory of 1868	2896	scvhots	35
PID 2896 wrote to memory of 1868	2896	scvhots	35
PID 2896 wrote to memory of 1868	2896	scvhots	35
PID 1868 wrote to memory of 2604	1868	scvhots	36
PID 1868 wrote to memory of 2604	1868	scvhots	36
PID 1868 wrote to memory of 2604	1868	scvhots	36
PID 1868 wrote to memory of 2604	1868	scvhots	36
PID 2604 wrote to memory of 1292	2604	scvhots	37
PID 2604 wrote to memory of 1292	2604	scvhots	37
PID 2604 wrote to memory of 1292	2604	scvhots	37
PID 2604 wrote to memory of 1292	2604	scvhots	37
PID 1292 wrote to memory of 2308	1292	scvhots	38
PID 1292 wrote to memory of 2308	1292	scvhots	38
PID 1292 wrote to memory of 2308	1292	scvhots	38
PID 1292 wrote to memory of 2308	1292	scvhots	38
PID 2308 wrote to memory of 1844	2308	scvhots	39
PID 2308 wrote to memory of 1844	2308	scvhots	39
PID 2308 wrote to memory of 1844	2308	scvhots	39
PID 2308 wrote to memory of 1844	2308	scvhots	39

C:\Users\Admin\AppData\Local\Temp\61691a314c2f3d3f825243d9560623cd.exe
"C:\Users\Admin\AppData\Local\Temp\61691a314c2f3d3f825243d9560623cd.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\scvhots
  C:\Windows\system32\scvhots 464 "C:\Users\Admin\AppData\Local\Temp\61691a314c2f3d3f825243d9560623cd.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\SysWOW64\scvhots
    C:\Windows\system32\scvhots 516 "C:\Windows\SysWOW64\scvhots"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Windows\SysWOW64\scvhots
      C:\Windows\system32\scvhots 512 "C:\Windows\SysWOW64\scvhots"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:3056
    - - C:\Windows\SysWOW64\scvhots
        
        C:\Windows\system32\scvhots 508 "C:\Windows\SysWOW64\scvhots"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1576
      - C:\Windows\SysWOW64\scvhots
        
        C:\Windows\system32\scvhots 524 "C:\Windows\SysWOW64\scvhots"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2896
        
        C:\Windows\SysWOW64\scvhots
        
        C:\Windows\system32\scvhots 528 "C:\Windows\SysWOW64\scvhots"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1868
        
        C:\Windows\SysWOW64\scvhots
        
        C:\Windows\system32\scvhots 520 "C:\Windows\SysWOW64\scvhots"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2604
        
        C:\Windows\SysWOW64\scvhots
        
        C:\Windows\system32\scvhots 532 "C:\Windows\SysWOW64\scvhots"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1292
        
        C:\Windows\SysWOW64\scvhots
        
        C:\Windows\system32\scvhots 536 "C:\Windows\SysWOW64\scvhots"
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2308
        
        C:\Windows\SysWOW64\scvhots
        
        C:\Windows\system32\scvhots 548 "C:\Windows\SysWOW64\scvhots"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

scvhots

Path \Windows\SysWOW64\scvhots
Size 102KB
SHA256 f01ed8e6605e38c8c2b59873b5bb927cd9e861e6acc0d5d184757ae6097de137
MD5 61691a314c2f3d3f825243d9560623cd
SHA1 644889d387bff0fe25bd9bc2138841a9379f7344
SHA512 190fd4137108c9f328d3e5abdd709ae26715c921b46fa0f832737db60e606487b49e542c375c847afee0d4c97b5e5aa7e6d8ed2115e0ae469b61d17f1be9195b
SSDEEP 3072:Y3wsezUFc5qVUpxReh0BiU0YADxZo+oaHA+EokeYSNJB:YAsDczx0LJYADxa+oaH3keYS7B
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1292-64-0x0000000000400000-0x0000000000496000-memory.dmp

Download

memory/1576-41-0x0000000000020000-0x0000000000022000-memory.dmp

Download

memory/1576-37-0x0000000000400000-0x0000000000496000-memory.dmp

Download

memory/1576-35-0x0000000000020000-0x0000000000022000-memory.dmp

Download

memory/1844-74-0x0000000000400000-0x0000000000496000-memory.dmp

Download

memory/1868-51-0x0000000000400000-0x0000000000496000-memory.dmp

Download

memory/1868-48-0x0000000000400000-0x0000000000496000-memory.dmp

Download

memory/1868-49-0x0000000000020000-0x0000000000022000-memory.dmp

Download

memory/2308-69-0x0000000000400000-0x0000000000496000-memory.dmp

Download

memory/2416-0-0x0000000000400000-0x0000000000496000-memory.dmp

Download

memory/2416-16-0x0000000000400000-0x0000000000496000-memory.dmp

Download

memory/2416-6-0x00000000025D0000-0x0000000002666000-memory.dmp

Download

memory/2416-1-0x0000000000020000-0x0000000000022000-memory.dmp

Download

memory/2604-62-0x0000000000020000-0x0000000000022000-memory.dmp

Download

memory/2604-58-0x0000000000400000-0x0000000000496000-memory.dmp

Download

memory/2604-56-0x0000000000400000-0x0000000000496000-memory.dmp

Download

memory/2604-55-0x0000000000020000-0x0000000000022000-memory.dmp

Download

memory/2644-17-0x0000000000400000-0x0000000000496000-memory.dmp

Download

memory/2644-20-0x0000000002460000-0x00000000024F6000-memory.dmp

Download

memory/2644-14-0x0000000000020000-0x0000000000022000-memory.dmp

Download

memory/2644-13-0x0000000000400000-0x0000000000496000-memory.dmp

Download

memory/2796-24-0x0000000000400000-0x0000000000496000-memory.dmp

Download

memory/2796-22-0x0000000000400000-0x0000000000496000-memory.dmp

Download

memory/2896-44-0x0000000000400000-0x0000000000496000-memory.dmp

Download

memory/2896-42-0x0000000000020000-0x0000000000022000-memory.dmp

Download

memory/3056-31-0x0000000000400000-0x0000000000496000-memory.dmp

Download

memory/3056-28-0x0000000000400000-0x0000000000496000-memory.dmp

Download

memory/3056-29-0x0000000000020000-0x0000000000022000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads