metasploit | e7eeee8e17c19e8db6377e68253f744f6e7e9df9070efc1a911332484a1ddf06

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 02:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8e0a35f3824c62628a16eb2877a46cc0.exe
Size 207KB
Sample240204-dera5sfff2
SHA256 e7eeee8e17c19e8db6377e68253f744f6e7e9df9070efc1a911332484a1ddf06
MD5 8e0a35f3824c62628a16eb2877a46cc0
SHA1 51a9efda2dc7b629ee96b46e08abc2ff1348b9f7
SHA512 56644a2421fedf90374775da933312a329dbdd9a397b2b3ce1961a3389dbb5e94d552026f89febb02a53a64fe5d46d73bfe0de996ef63aab5e7107312f4d1c78
SSDEEP 3072:A59NPYs7BGbxKcLSJ4P6CowCkPOQLPlDS8PmbE2yprdHqLptOp0J2YcP8su9waM0:ADR1KKBSrowC25hD3PuEfv0ptOfYcgXX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Executes dropped EXE 20 IoCs

pid	Process
2804	msq23.exe
2696	msq23.exe
2860	msq23.exe
2588	msq23.exe
768	msq23.exe
1144	msq23.exe
1988	msq23.exe
1572	msq23.exe
2640	msq23.exe
1512	msq23.exe
1500	msq23.exe
2252	msq23.exe
1700	msq23.exe
2320	msq23.exe
1872	msq23.exe
2248	msq23.exe
1760	msq23.exe
3068	msq23.exe
2408	msq23.exe
2316	msq23.exe

Loads dropped DLL 21 IoCs

pid	Process
2196	8e0a35f3824c62628a16eb2877a46cc0.exe
2196	8e0a35f3824c62628a16eb2877a46cc0.exe
2804	msq23.exe
2696	msq23.exe
2696	msq23.exe
2588	msq23.exe
2588	msq23.exe
1144	msq23.exe
1144	msq23.exe
1572	msq23.exe
1572	msq23.exe
1512	msq23.exe
1512	msq23.exe
2252	msq23.exe
2252	msq23.exe
2320	msq23.exe
2320	msq23.exe
2248	msq23.exe
2248	msq23.exe
3068	msq23.exe
3068	msq23.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File opened for modification	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File created	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File created	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File opened for modification	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File opened for modification	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File created	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File created	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File created	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File opened for modification	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File created	C:\Windows\SysWOW64\msq23.exe	8e0a35f3824c62628a16eb2877a46cc0.exe
File opened for modification	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File created	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File opened for modification	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File opened for modification	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File created	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File created	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File created	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File opened for modification	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File opened for modification	C:\Windows\SysWOW64\msq23.exe	8e0a35f3824c62628a16eb2877a46cc0.exe
File opened for modification	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File created	C:\Windows\SysWOW64\msq23.exe	msq23.exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 2876 set thread context of 2196	2876	8e0a35f3824c62628a16eb2877a46cc0.exe	3
PID 2804 set thread context of 2696	2804	msq23.exe	1
PID 2860 set thread context of 2588	2860	msq23.exe	32
PID 768 set thread context of 1144	768	msq23.exe	34
PID 1988 set thread context of 1572	1988	msq23.exe	38
PID 2640 set thread context of 1512	2640	msq23.exe	40
PID 1500 set thread context of 2252	1500	msq23.exe	42
PID 1700 set thread context of 2320	1700	msq23.exe	44
PID 1872 set thread context of 2248	1872	msq23.exe	46
PID 1760 set thread context of 3068	1760	msq23.exe	48
PID 2408 set thread context of 2316	2408	msq23.exe	50

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2876	8e0a35f3824c62628a16eb2877a46cc0.exe
2804	msq23.exe
2860	msq23.exe
768	msq23.exe
1988	msq23.exe
2640	msq23.exe
1500	msq23.exe
1700	msq23.exe
1872	msq23.exe
1760	msq23.exe
2408	msq23.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2196	2876	8e0a35f3824c62628a16eb2877a46cc0.exe	3
PID 2876 wrote to memory of 2196	2876	8e0a35f3824c62628a16eb2877a46cc0.exe	3
PID 2876 wrote to memory of 2196	2876	8e0a35f3824c62628a16eb2877a46cc0.exe	3
PID 2876 wrote to memory of 2196	2876	8e0a35f3824c62628a16eb2877a46cc0.exe	3
PID 2876 wrote to memory of 2196	2876	8e0a35f3824c62628a16eb2877a46cc0.exe	3
PID 2876 wrote to memory of 2196	2876	8e0a35f3824c62628a16eb2877a46cc0.exe	3
PID 2196 wrote to memory of 2804	2196	8e0a35f3824c62628a16eb2877a46cc0.exe	2
PID 2196 wrote to memory of 2804	2196	8e0a35f3824c62628a16eb2877a46cc0.exe	2
PID 2196 wrote to memory of 2804	2196	8e0a35f3824c62628a16eb2877a46cc0.exe	2
PID 2196 wrote to memory of 2804	2196	8e0a35f3824c62628a16eb2877a46cc0.exe	2
PID 2804 wrote to memory of 2696	2804	msq23.exe	1
PID 2804 wrote to memory of 2696	2804	msq23.exe	1
PID 2804 wrote to memory of 2696	2804	msq23.exe	1
PID 2804 wrote to memory of 2696	2804	msq23.exe	1
PID 2804 wrote to memory of 2696	2804	msq23.exe	1
PID 2804 wrote to memory of 2696	2804	msq23.exe	1
PID 2696 wrote to memory of 2860	2696	msq23.exe	31
PID 2696 wrote to memory of 2860	2696	msq23.exe	31
PID 2696 wrote to memory of 2860	2696	msq23.exe	31
PID 2696 wrote to memory of 2860	2696	msq23.exe	31
PID 2860 wrote to memory of 2588	2860	msq23.exe	32
PID 2860 wrote to memory of 2588	2860	msq23.exe	32
PID 2860 wrote to memory of 2588	2860	msq23.exe	32
PID 2860 wrote to memory of 2588	2860	msq23.exe	32
PID 2860 wrote to memory of 2588	2860	msq23.exe	32
PID 2860 wrote to memory of 2588	2860	msq23.exe	32
PID 2588 wrote to memory of 768	2588	msq23.exe	33
PID 2588 wrote to memory of 768	2588	msq23.exe	33
PID 2588 wrote to memory of 768	2588	msq23.exe	33
PID 2588 wrote to memory of 768	2588	msq23.exe	33
PID 768 wrote to memory of 1144	768	msq23.exe	34
PID 768 wrote to memory of 1144	768	msq23.exe	34
PID 768 wrote to memory of 1144	768	msq23.exe	34
PID 768 wrote to memory of 1144	768	msq23.exe	34
PID 768 wrote to memory of 1144	768	msq23.exe	34
PID 768 wrote to memory of 1144	768	msq23.exe	34
PID 1144 wrote to memory of 1988	1144	msq23.exe	37
PID 1144 wrote to memory of 1988	1144	msq23.exe	37
PID 1144 wrote to memory of 1988	1144	msq23.exe	37
PID 1144 wrote to memory of 1988	1144	msq23.exe	37
PID 1988 wrote to memory of 1572	1988	msq23.exe	38
PID 1988 wrote to memory of 1572	1988	msq23.exe	38
PID 1988 wrote to memory of 1572	1988	msq23.exe	38
PID 1988 wrote to memory of 1572	1988	msq23.exe	38
PID 1988 wrote to memory of 1572	1988	msq23.exe	38
PID 1988 wrote to memory of 1572	1988	msq23.exe	38
PID 1572 wrote to memory of 2640	1572	msq23.exe	39
PID 1572 wrote to memory of 2640	1572	msq23.exe	39
PID 1572 wrote to memory of 2640	1572	msq23.exe	39
PID 1572 wrote to memory of 2640	1572	msq23.exe	39
PID 2640 wrote to memory of 1512	2640	msq23.exe	40
PID 2640 wrote to memory of 1512	2640	msq23.exe	40
PID 2640 wrote to memory of 1512	2640	msq23.exe	40
PID 2640 wrote to memory of 1512	2640	msq23.exe	40
PID 2640 wrote to memory of 1512	2640	msq23.exe	40
PID 2640 wrote to memory of 1512	2640	msq23.exe	40
PID 1512 wrote to memory of 1500	1512	msq23.exe	41
PID 1512 wrote to memory of 1500	1512	msq23.exe	41
PID 1512 wrote to memory of 1500	1512	msq23.exe	41
PID 1512 wrote to memory of 1500	1512	msq23.exe	41
PID 1500 wrote to memory of 2252	1500	msq23.exe	42
PID 1500 wrote to memory of 2252	1500	msq23.exe	42
PID 1500 wrote to memory of 2252	1500	msq23.exe	42
PID 1500 wrote to memory of 2252	1500	msq23.exe	42

C:\Windows\SysWOW64\msq23.exe
C:\Windows\SysWOW64\msq23.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\msq23.exe
  C:\Windows\system32\msq23.exe 524 "C:\Windows\SysWOW64\msq23.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Windows\SysWOW64\msq23.exe
    C:\Windows\SysWOW64\msq23.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:2588
  - - C:\Windows\SysWOW64\msq23.exe
      C:\Windows\system32\msq23.exe 524 "C:\Windows\SysWOW64\msq23.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:768
    - - C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\SysWOW64\msq23.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1144
      - C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\system32\msq23.exe 524 "C:\Windows\SysWOW64\msq23.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1988
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\SysWOW64\msq23.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1572
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\system32\msq23.exe 524 "C:\Windows\SysWOW64\msq23.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2640
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\SysWOW64\msq23.exe
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1512
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\system32\msq23.exe 524 "C:\Windows\SysWOW64\msq23.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1500
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\SysWOW64\msq23.exe
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2252
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\system32\msq23.exe 524 "C:\Windows\SysWOW64\msq23.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:1700
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\SysWOW64\msq23.exe
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2320
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\system32\msq23.exe 524 "C:\Windows\SysWOW64\msq23.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:1872
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\SysWOW64\msq23.exe
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2248
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\system32\msq23.exe 524 "C:\Windows\SysWOW64\msq23.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:1760
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\SysWOW64\msq23.exe
        17⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:3068
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\system32\msq23.exe 524 "C:\Windows\SysWOW64\msq23.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:2408
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\SysWOW64\msq23.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2316

C:\Windows\SysWOW64\msq23.exe
C:\Windows\system32\msq23.exe 536 "C:\Users\Admin\AppData\Local\Temp\8e0a35f3824c62628a16eb2877a46cc0.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2804

C:\Users\Admin\AppData\Local\Temp\8e0a35f3824c62628a16eb2877a46cc0.exe
C:\Users\Admin\AppData\Local\Temp\8e0a35f3824c62628a16eb2877a46cc0.exe
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2196

C:\Users\Admin\AppData\Local\Temp\8e0a35f3824c62628a16eb2877a46cc0.exe
"C:\Users\Admin\AppData\Local\Temp\8e0a35f3824c62628a16eb2877a46cc0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

msq23.exe

Path C:\Windows\SysWOW64\msq23.exe
Size 207KB
SHA256 e7eeee8e17c19e8db6377e68253f744f6e7e9df9070efc1a911332484a1ddf06
MD5 8e0a35f3824c62628a16eb2877a46cc0
SHA1 51a9efda2dc7b629ee96b46e08abc2ff1348b9f7
SHA512 56644a2421fedf90374775da933312a329dbdd9a397b2b3ce1961a3389dbb5e94d552026f89febb02a53a64fe5d46d73bfe0de996ef63aab5e7107312f4d1c78
SSDEEP 3072:A59NPYs7BGbxKcLSJ4P6CowCkPOQLPlDS8PmbE2yprdHqLptOp0J2YcP8su9waM0:ADR1KKBSrowC25hD3PuEfv0ptOfYcgXX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/768-59-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/1144-78-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/1144-68-0x0000000000550000-0x0000000000588000-memory.dmp

Download

memory/1144-64-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/1500-104-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/1500-100-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/1512-98-0x0000000000550000-0x0000000000588000-memory.dmp

Download

memory/1512-108-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/1512-94-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/1572-79-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/1572-93-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/1572-83-0x0000000002800000-0x0000000002838000-memory.dmp

Download

memory/1700-120-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/1700-115-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/1760-154-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/1760-146-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/1872-130-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/1872-135-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/1988-74-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/1988-71-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/2196-6-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/2196-10-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/2196-21-0x0000000002560000-0x0000000002598000-memory.dmp

Download

memory/2196-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2196-9-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/2196-33-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/2196-1-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/2248-142-0x00000000007F0000-0x0000000000828000-memory.dmp

Download

memory/2248-155-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/2248-139-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/2248-144-0x00000000007F0000-0x0000000000828000-memory.dmp

Download

memory/2252-113-0x0000000000650000-0x0000000000688000-memory.dmp

Download

memory/2252-109-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/2252-123-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/2316-174-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/2320-138-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/2320-124-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/2320-128-0x00000000007B0000-0x00000000007E8000-memory.dmp

Download

memory/2408-164-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/2408-171-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/2588-48-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/2588-51-0x00000000024E0000-0x0000000002518000-memory.dmp

Download

memory/2588-53-0x00000000024E0000-0x0000000002518000-memory.dmp

Download

memory/2588-63-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/2640-85-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/2640-90-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/2696-34-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/2696-46-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/2804-26-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/2804-30-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/2860-43-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/2860-38-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/2876-2-0x0000000000220000-0x0000000000258000-memory.dmp

Download

memory/2876-7-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/2876-0-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/3068-161-0x0000000000790000-0x00000000007C8000-memory.dmp

Download

memory/3068-163-0x0000000000790000-0x00000000007C8000-memory.dmp

Download

memory/3068-157-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/3068-172-0x0000000000400000-0x000000000050B000-memory.dmp

Download