metasploit | e7eeee8e17c19e8db6377e68253f744f6e7e9df9070efc1a911332484a1ddf06

Analysis

max time kernel
144s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 02:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8e0a35f3824c62628a16eb2877a46cc0.exe
Size 207KB
Sample240204-dera5sfff2
SHA256 e7eeee8e17c19e8db6377e68253f744f6e7e9df9070efc1a911332484a1ddf06
MD5 8e0a35f3824c62628a16eb2877a46cc0
SHA1 51a9efda2dc7b629ee96b46e08abc2ff1348b9f7
SHA512 56644a2421fedf90374775da933312a329dbdd9a397b2b3ce1961a3389dbb5e94d552026f89febb02a53a64fe5d46d73bfe0de996ef63aab5e7107312f4d1c78
SSDEEP 3072:A59NPYs7BGbxKcLSJ4P6CowCkPOQLPlDS8PmbE2yprdHqLptOp0J2YcP8su9waM0:ADR1KKBSrowC25hD3PuEfv0ptOfYcgXX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Executes dropped EXE 20 IoCs

pid	Process
4940	msq23.exe
4884	msq23.exe
1880	msq23.exe
3264	msq23.exe
2896	msq23.exe
1780	msq23.exe
2460	msq23.exe
3844	msq23.exe
4020	msq23.exe
640	msq23.exe
2212	msq23.exe
4992	msq23.exe
4784	msq23.exe
5092	msq23.exe
1152	msq23.exe
3352	msq23.exe
2324	msq23.exe
316	msq23.exe
2436	msq23.exe
4176	msq23.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File created	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File opened for modification	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File opened for modification	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File created	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File created	C:\Windows\SysWOW64\msq23.exe	8e0a35f3824c62628a16eb2877a46cc0.exe
File opened for modification	C:\Windows\SysWOW64\msq23.exe	8e0a35f3824c62628a16eb2877a46cc0.exe
File created	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File opened for modification	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File created	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File opened for modification	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File opened for modification	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File created	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File opened for modification	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File created	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File created	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File opened for modification	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File opened for modification	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File opened for modification	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File created	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File opened for modification	C:\Windows\SysWOW64\msq23.exe	msq23.exe
File created	C:\Windows\SysWOW64\msq23.exe	msq23.exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 1816 set thread context of 4764	1816	8e0a35f3824c62628a16eb2877a46cc0.exe	85
PID 4940 set thread context of 4884	4940	msq23.exe	86
PID 1880 set thread context of 3264	1880	msq23.exe	100
PID 2896 set thread context of 1780	2896	msq23.exe	103
PID 2460 set thread context of 3844	2460	msq23.exe	105
PID 4020 set thread context of 640	4020	msq23.exe	107
PID 2212 set thread context of 4992	2212	msq23.exe	109
PID 4784 set thread context of 5092	4784	msq23.exe	111
PID 1152 set thread context of 3352	1152	msq23.exe	113
PID 2324 set thread context of 316	2324	msq23.exe	115
PID 2436 set thread context of 4176	2436	msq23.exe	117

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1816	8e0a35f3824c62628a16eb2877a46cc0.exe
1816	8e0a35f3824c62628a16eb2877a46cc0.exe
4940	msq23.exe
4940	msq23.exe
1880	msq23.exe
1880	msq23.exe
2896	msq23.exe
2896	msq23.exe
2460	msq23.exe
2460	msq23.exe
4020	msq23.exe
4020	msq23.exe
2212	msq23.exe
2212	msq23.exe
4784	msq23.exe
4784	msq23.exe
1152	msq23.exe
1152	msq23.exe
2324	msq23.exe
2324	msq23.exe
2436	msq23.exe
2436	msq23.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 4764	1816	8e0a35f3824c62628a16eb2877a46cc0.exe	85
PID 1816 wrote to memory of 4764	1816	8e0a35f3824c62628a16eb2877a46cc0.exe	85
PID 1816 wrote to memory of 4764	1816	8e0a35f3824c62628a16eb2877a46cc0.exe	85
PID 1816 wrote to memory of 4764	1816	8e0a35f3824c62628a16eb2877a46cc0.exe	85
PID 1816 wrote to memory of 4764	1816	8e0a35f3824c62628a16eb2877a46cc0.exe	85
PID 4764 wrote to memory of 4940	4764	8e0a35f3824c62628a16eb2877a46cc0.exe	90
PID 4764 wrote to memory of 4940	4764	8e0a35f3824c62628a16eb2877a46cc0.exe	90
PID 4764 wrote to memory of 4940	4764	8e0a35f3824c62628a16eb2877a46cc0.exe	90
PID 4940 wrote to memory of 4884	4940	msq23.exe	86
PID 4940 wrote to memory of 4884	4940	msq23.exe	86
PID 4940 wrote to memory of 4884	4940	msq23.exe	86
PID 4940 wrote to memory of 4884	4940	msq23.exe	86
PID 4940 wrote to memory of 4884	4940	msq23.exe	86
PID 4884 wrote to memory of 1880	4884	msq23.exe	99
PID 4884 wrote to memory of 1880	4884	msq23.exe	99
PID 4884 wrote to memory of 1880	4884	msq23.exe	99
PID 1880 wrote to memory of 3264	1880	msq23.exe	100
PID 1880 wrote to memory of 3264	1880	msq23.exe	100
PID 1880 wrote to memory of 3264	1880	msq23.exe	100
PID 1880 wrote to memory of 3264	1880	msq23.exe	100
PID 1880 wrote to memory of 3264	1880	msq23.exe	100
PID 3264 wrote to memory of 2896	3264	msq23.exe	102
PID 3264 wrote to memory of 2896	3264	msq23.exe	102
PID 3264 wrote to memory of 2896	3264	msq23.exe	102
PID 2896 wrote to memory of 1780	2896	msq23.exe	103
PID 2896 wrote to memory of 1780	2896	msq23.exe	103
PID 2896 wrote to memory of 1780	2896	msq23.exe	103
PID 2896 wrote to memory of 1780	2896	msq23.exe	103
PID 2896 wrote to memory of 1780	2896	msq23.exe	103
PID 1780 wrote to memory of 2460	1780	msq23.exe	104
PID 1780 wrote to memory of 2460	1780	msq23.exe	104
PID 1780 wrote to memory of 2460	1780	msq23.exe	104
PID 2460 wrote to memory of 3844	2460	msq23.exe	105
PID 2460 wrote to memory of 3844	2460	msq23.exe	105
PID 2460 wrote to memory of 3844	2460	msq23.exe	105
PID 2460 wrote to memory of 3844	2460	msq23.exe	105
PID 2460 wrote to memory of 3844	2460	msq23.exe	105
PID 3844 wrote to memory of 4020	3844	msq23.exe	106
PID 3844 wrote to memory of 4020	3844	msq23.exe	106
PID 3844 wrote to memory of 4020	3844	msq23.exe	106
PID 4020 wrote to memory of 640	4020	msq23.exe	107
PID 4020 wrote to memory of 640	4020	msq23.exe	107
PID 4020 wrote to memory of 640	4020	msq23.exe	107
PID 4020 wrote to memory of 640	4020	msq23.exe	107
PID 4020 wrote to memory of 640	4020	msq23.exe	107
PID 640 wrote to memory of 2212	640	msq23.exe	108
PID 640 wrote to memory of 2212	640	msq23.exe	108
PID 640 wrote to memory of 2212	640	msq23.exe	108
PID 2212 wrote to memory of 4992	2212	msq23.exe	109
PID 2212 wrote to memory of 4992	2212	msq23.exe	109
PID 2212 wrote to memory of 4992	2212	msq23.exe	109
PID 2212 wrote to memory of 4992	2212	msq23.exe	109
PID 2212 wrote to memory of 4992	2212	msq23.exe	109
PID 4992 wrote to memory of 4784	4992	msq23.exe	110
PID 4992 wrote to memory of 4784	4992	msq23.exe	110
PID 4992 wrote to memory of 4784	4992	msq23.exe	110
PID 4784 wrote to memory of 5092	4784	msq23.exe	111
PID 4784 wrote to memory of 5092	4784	msq23.exe	111
PID 4784 wrote to memory of 5092	4784	msq23.exe	111
PID 4784 wrote to memory of 5092	4784	msq23.exe	111
PID 4784 wrote to memory of 5092	4784	msq23.exe	111
PID 5092 wrote to memory of 1152	5092	msq23.exe	112
PID 5092 wrote to memory of 1152	5092	msq23.exe	112
PID 5092 wrote to memory of 1152	5092	msq23.exe	112

C:\Users\Admin\AppData\Local\Temp\8e0a35f3824c62628a16eb2877a46cc0.exe
"C:\Users\Admin\AppData\Local\Temp\8e0a35f3824c62628a16eb2877a46cc0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Users\Admin\AppData\Local\Temp\8e0a35f3824c62628a16eb2877a46cc0.exe
  C:\Users\Admin\AppData\Local\Temp\8e0a35f3824c62628a16eb2877a46cc0.exe
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Windows\SysWOW64\msq23.exe
    C:\Windows\system32\msq23.exe 1004 "C:\Users\Admin\AppData\Local\Temp\8e0a35f3824c62628a16eb2877a46cc0.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4940

C:\Windows\SysWOW64\msq23.exe
C:\Windows\SysWOW64\msq23.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\SysWOW64\msq23.exe
  C:\Windows\system32\msq23.exe 1148 "C:\Windows\SysWOW64\msq23.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Windows\SysWOW64\msq23.exe
    C:\Windows\SysWOW64\msq23.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:3264
  - - C:\Windows\SysWOW64\msq23.exe
      C:\Windows\system32\msq23.exe 1120 "C:\Windows\SysWOW64\msq23.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2896
    - - C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\SysWOW64\msq23.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1780
      - C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\system32\msq23.exe 1124 "C:\Windows\SysWOW64\msq23.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2460
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\SysWOW64\msq23.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3844
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\system32\msq23.exe 1120 "C:\Windows\SysWOW64\msq23.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4020
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\SysWOW64\msq23.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:640
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\system32\msq23.exe 1120 "C:\Windows\SysWOW64\msq23.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2212
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\SysWOW64\msq23.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4992
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\system32\msq23.exe 1120 "C:\Windows\SysWOW64\msq23.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4784
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\SysWOW64\msq23.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5092
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\system32\msq23.exe 1120 "C:\Windows\SysWOW64\msq23.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:1152
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\SysWOW64\msq23.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3352
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\system32\msq23.exe 1120 "C:\Windows\SysWOW64\msq23.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:2324
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\SysWOW64\msq23.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:316
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\system32\msq23.exe 1112 "C:\Windows\SysWOW64\msq23.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:2436
        
        C:\Windows\SysWOW64\msq23.exe
        
        C:\Windows\SysWOW64\msq23.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

msq23.exe

Path C:\Windows\SysWOW64\msq23.exe
Size 207KB
SHA256 e7eeee8e17c19e8db6377e68253f744f6e7e9df9070efc1a911332484a1ddf06
MD5 8e0a35f3824c62628a16eb2877a46cc0
SHA1 51a9efda2dc7b629ee96b46e08abc2ff1348b9f7
SHA512 56644a2421fedf90374775da933312a329dbdd9a397b2b3ce1961a3389dbb5e94d552026f89febb02a53a64fe5d46d73bfe0de996ef63aab5e7107312f4d1c78
SSDEEP 3072:A59NPYs7BGbxKcLSJ4P6CowCkPOQLPlDS8PmbE2yprdHqLptOp0J2YcP8su9waM0:ADR1KKBSrowC25hD3PuEfv0ptOfYcgXX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/316-95-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/316-85-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/640-61-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/640-52-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/1152-73-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/1780-45-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/1780-36-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/1816-2-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/1816-0-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/1880-25-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/2212-59-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/2324-82-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/2324-79-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/2436-88-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/2436-92-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/2460-41-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/2896-30-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/2896-33-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/3264-27-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/3264-37-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/3352-76-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/3352-86-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/3844-44-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/3844-53-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/4020-49-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/4176-94-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/4764-4-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/4764-20-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/4764-1-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/4764-6-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/4764-5-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/4784-65-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/4884-19-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/4884-28-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/4940-16-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/4940-13-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/4992-60-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/4992-69-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/5092-77-0x0000000000400000-0x000000000050B000-memory.dmp

Download

memory/5092-68-0x0000000000400000-0x000000000050B000-memory.dmp

Download