metasploit | 2da778e424290eac8d86493433451545f1edf48f0abf9bdb57efccb332708fc1

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/02/2024, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-02-05_09ef3f1729afae68af46f1ef5a11347c_karagany_mafia.exe
Size 2.9MB
Sample240205-srekfachgl
SHA256 2da778e424290eac8d86493433451545f1edf48f0abf9bdb57efccb332708fc1
MD5 09ef3f1729afae68af46f1ef5a11347c
SHA1 4b1fa6d618b0923b55fc15c3cb432af475eae4d3
SHA512 aaa8f7a3ac7f9c79fbf7defa3dfbe41b15a7f109a3fa5e87b3dabab98aa37e421870a3da09c0c322ed66bd959f5a4f6334db03b9ba5205cab98be9a5c7d83961
SSDEEP 49152:otg7ETQsdvQ7ignedJAFoenaQzqhwCdxKKTUqZIt7tTt+YsaGGCj/TeDeJQxHEE3:mtdvtge4bmaKZUga7tMFGNDtNEcJN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/download_exec

http://216.24.57.3:853/xsGu

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Loads dropped DLL 4 IoCs

pid	Process
2700	2024-02-05_09ef3f1729afae68af46f1ef5a11347c_karagany_mafia.exe
2700	2024-02-05_09ef3f1729afae68af46f1ef5a11347c_karagany_mafia.exe
2700	2024-02-05_09ef3f1729afae68af46f1ef5a11347c_karagany_mafia.exe
2700	2024-02-05_09ef3f1729afae68af46f1ef5a11347c_karagany_mafia.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2700	2876	2024-02-05_09ef3f1729afae68af46f1ef5a11347c_karagany_mafia.exe	28
PID 2876 wrote to memory of 2700	2876	2024-02-05_09ef3f1729afae68af46f1ef5a11347c_karagany_mafia.exe	28
PID 2876 wrote to memory of 2700	2876	2024-02-05_09ef3f1729afae68af46f1ef5a11347c_karagany_mafia.exe	28
PID 2876 wrote to memory of 2700	2876	2024-02-05_09ef3f1729afae68af46f1ef5a11347c_karagany_mafia.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-05_09ef3f1729afae68af46f1ef5a11347c_karagany_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-05_09ef3f1729afae68af46f1ef5a11347c_karagany_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Users\Admin\AppData\Local\Temp\2024-02-05_09ef3f1729afae68af46f1ef5a11347c_karagany_mafia.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-02-05_09ef3f1729afae68af46f1ef5a11347c_karagany_mafia.exe"
  2⤵
  - Loads dropped DLL
  PID:2700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Crypto.Cipher._AES.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28762\Crypto.Cipher._AES.pyd
Size 28KB
SHA256 51054f4d28782b6698b1b6510317650e797e11f87fa29fceaf8559b6bcbf4dfe
MD5 dd3db5480eb52e8f69d47f3b725e6bfb
SHA1 cb14cda7f5e3e2b88c823e4d15643680398b361e
SHA512 c94216dcd0dc3000304b2b4704dd29bfeed35c9b6158d3ff1cc86084a1753060b72bd48678d5662c8e10205e1a866361f7a455f177dbf364814ee317679bff23
SSDEEP 384:9KckxaWHQuFS1bIYcBjZjKPzA37usOo8Vd6IHiPKDkAKB5F0riz4BPK27raf0:9DkxaywpjcJhaAahoICS4AI3GDm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Crypto.Cipher._DES.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28762\Crypto.Cipher._DES.pyd
Size 53KB
SHA256 07e039cdb74dc84ef43eb3e03ca1516eaa8995c2e5cde5817a51ba87a1d6946f
MD5 5be8826aa5ad6886c4a6f06f46f6f95b
SHA1 d55051cf2a2f406e8402fb9123d5b0aacbbbc32d
SHA512 ac033322f29ad6d60664b847ad611bd80b6f8992ae568c70343bbcdac0af94daf04bb262a0b0548ca6ecad9bdaadd63ee1e4421c28ed000a3a25b9ebb530bfed
SSDEEP 384:/OwYLx5h7kir1Zsl72lpScJr4r5Zaqb/K27DK3Wy:2vLx5hYixZ62lr6NH
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28762\_ctypes.pyd
Size 85KB
SHA256 f6fb937147342609a793a1ccb839ad504ec0e7807d072a9ac6eb51ba846e17a9
MD5 d0e6bee31c7f2b0de979562ce5f6444f
SHA1 9223853061b067f7af17007067d24ce746917d1d
SHA512 3d64a460178479eec3cd1a65421dafb78b15011fcae472873ab28fb1ecc42482d00b141426874b12beef9247ad6b4afe1bd723d398f37d44316bc1b9c4dba434
SSDEEP 1536:S5UaGQqLGLMNN/LWPkNMCpNOwMz9GgesXr3lYjgxca0k9R/EcnBONca5XB:DL2k/pNtzOwoesXIgxcU/PBOOa5x
MD5 SHA1 SHA512 SSDEEP

Submit Download

python27.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI28762\python27.dll
Size 2.0MB
SHA256 a3d1245c2cbe78f836140f5c12fa4f2ca063aa745f7ad3cc8e08a65f92aa9fd8
MD5 f2916efdeb7d5478bc3f01a2fa79dbe6
SHA1 45d9b825478a82a0ddc94d97b071828fdd6bbf45
SHA512 11d3101c4834d465ecc65dfcfcb6871a57aef6ea56ca11fe1298bbe3bb19c66d99824570f7780c00185afed9f4411da611270ba4439dd07919afc5e252eaa878
SSDEEP 49152:ut10lzfk7DxLbGUJiNlc3j2a1eUCfTP8IVJHDEn9MRaPavWNP8:utKUJi0b12p3Ho9MR52U
MD5 SHA1 SHA512 SSDEEP

Submit Download

python27.dll

Path \Users\Admin\AppData\Local\Temp\_MEI28762\python27.dll
Size 2.3MB
SHA256 5c4f7eb850cb4ebd35c039be7319e2ed05439418884d414001e015c4637585fc
MD5 df1a706ed563fa3f0b48f427609708f4
SHA1 5c479ffca8a2d71023c2522f54ed3f6f36f88e79
SHA512 8757e27d78291f48237a5b4b15cea26d08d03c8b9ff1ad61c50d890b3e8b62fd0db819959b9c13b3d88ebe3e54ae176fc67d02ffe62c89c577af1866cb238a73
SSDEEP 49152:ut10lzfk7DxLbGUJiNlc3j2a1eUCfTP8IVJHDEn9MRaPavWNP9P7:utKUJi0b12p3Ho9MR521P7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2700-21-0x0000000000200000-0x0000000000210000-memory.dmp

Download

memory/2700-22-0x0000000000210000-0x0000000000211000-memory.dmp

Download

memory/2700-23-0x0000000000210000-0x0000000000211000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads