metasploit | 9505971f4637450dca608b07a5008bc2f3ec16d8bb3ca59c4ed8719da232f789

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
17/01/2024, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
61720480948ef6fd675ab4bdf7523883.exe
Size 480KB
Sample240117-cdltlafeg2
SHA256 9505971f4637450dca608b07a5008bc2f3ec16d8bb3ca59c4ed8719da232f789
MD5 61720480948ef6fd675ab4bdf7523883
SHA1 4c73a59d3e669816cd1651fe2330532149065abd
SHA512 432c6b2394c8494e4ad3423c52bf75e99b980ae2b929197c4f6065979909c1447036ee7e5fa6f63e32c9092c9015643ee74bde88e122033b8f16268f6ff8eee1
SSDEEP 6144:VNi0C7+KQ8ISTJ4/FmdYBxT9FzbHc31pLYm4Kf0Y35iZZSHCX61Hs0yqFf42vMJu:biz/IMaNBxa/9iCnCJqxLvf2KnLd9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metasploit backdoor themida trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Deletes itself 1 IoCs

pid	Process
2692	cmd.exe

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/3032-0-0x0000000000400000-0x0000000000481000-memory.dmp	themida

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dllcache\winmga.exe	61720480948ef6fd675ab4bdf7523883.exe
File opened for modification	C:\Windows\SysWOW64\dllcache\winmga.exe	61720480948ef6fd675ab4bdf7523883.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2692	3032	61720480948ef6fd675ab4bdf7523883.exe	28
PID 3032 wrote to memory of 2692	3032	61720480948ef6fd675ab4bdf7523883.exe	28
PID 3032 wrote to memory of 2692	3032	61720480948ef6fd675ab4bdf7523883.exe	28
PID 3032 wrote to memory of 2692	3032	61720480948ef6fd675ab4bdf7523883.exe	28

C:\Users\Admin\AppData\Local\Temp\61720480948ef6fd675ab4bdf7523883.exe
"C:\Users\Admin\AppData\Local\Temp\61720480948ef6fd675ab4bdf7523883.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\617204~1.EXE > NUL
  2⤵
  - Deletes itself
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3032-0-0x0000000000400000-0x0000000000481000-memory.dmp

Download