metasploit | c2bf26d1b3a311be1bec839ca7c26bf2c944fd79333485a271230ec435c318dd

Analysis

max time kernel
21s
max time network
17s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02-03-2024 20:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ransomware/Golden Eyes - via unikey.exe
Size

1.3MB
MD5

3f6bfaa577b7be13705f41cc5b6cb1eb
SHA1

0a9cd77276ac62848eeb1c428cf9f05c0e0ec69c
SHA256

21780731ba0394eaa38254960f445321f2ca10450623855d8e2f1d6e30481022
SHA512

9f02e7fc31f7fe3ebebebc4b38f49cd885f91b5bc3ee0b7c0cb2f19f2e8f983aebf671197471b61f624dbc13183bac66f8c19d50fb3a501c269ea3d1a9029ce1
SSDEEP

24576:/7blFG2wAhxKw0cDJ/ztH6NtCsL96AEwZIOd++kD4mRkdqbhm:/75o2FfKwT1/x2btFtsTD4mRkdqbhm

Score

10^/10

metasploit neshta backdoor bootkit discovery persistence spyware stealer trojan

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

Detect Neshta payload 2 IoCs

resource	yara_rule
behavioral16/files/0x0007000000023235-31.dat	family_neshta
behavioral16/files/0x0009000000023230-122.dat	family_neshta

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	UniKeyNT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	0.exe

Executes dropped EXE 5 IoCs

pid	Process
4912	Golden Eyes - via unikey.tmp
4176	UniKeyNT.exe
764	0.exe
1364	1.exe
2824	0.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	0.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	1.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\UniKey\UniKeyNT.exe	Golden Eyes - via unikey.tmp
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	0.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MIA062~1.EXE	0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13185~1.17\MICROS~1.EXE	0.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	0.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	0.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	0.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	0.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	0.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe	0.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE	0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	0.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	0.exe
File created	C:\Program Files (x86)\UniKey\is-IER07.tmp	Golden Eyes - via unikey.tmp
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	0.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	0.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	0.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	0.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe	0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	0.exe
File opened for modification	C:\PROGRA~2\UniKey\unins000.exe	0.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	0.exe
File created	C:\Program Files (x86)\UniKey\is-7IG06.tmp	Golden Eyes - via unikey.tmp
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	0.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MI9C33~1.EXE	0.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	0.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{17316~1\WINDOW~1.EXE	0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	0.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MI391D~1.EXE	0.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	0.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	0.exe
File created	C:\Program Files (x86)\UniKey\unins000.dat	Golden Eyes - via unikey.tmp
File created	C:\Program Files (x86)\UniKey\is-0IN2Q.tmp	Golden Eyes - via unikey.tmp
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	0.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	0.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	0.exe
File opened for modification	C:\Program Files (x86)\UniKey\unins000.dat	Golden Eyes - via unikey.tmp
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	0.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	0.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	0.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	0.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	0.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE	0.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	0.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	0.exe
File opened for modification	C:\PROGRA~2\UniKey\UniKeyNT.exe	0.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	0.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	0.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	0.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4912	Golden Eyes - via unikey.tmp
4912	Golden Eyes - via unikey.tmp

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1364	1.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4912	Golden Eyes - via unikey.tmp
2824	0.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2824	0.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2824	0.exe
2824	0.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 4912	2296	Golden Eyes - via unikey.exe	88
PID 2296 wrote to memory of 4912	2296	Golden Eyes - via unikey.exe	88
PID 2296 wrote to memory of 4912	2296	Golden Eyes - via unikey.exe	88
PID 4912 wrote to memory of 4176	4912	Golden Eyes - via unikey.tmp	94
PID 4912 wrote to memory of 4176	4912	Golden Eyes - via unikey.tmp	94
PID 4176 wrote to memory of 764	4176	UniKeyNT.exe	95
PID 4176 wrote to memory of 764	4176	UniKeyNT.exe	95
PID 4176 wrote to memory of 764	4176	UniKeyNT.exe	95
PID 4176 wrote to memory of 1364	4176	UniKeyNT.exe	96
PID 4176 wrote to memory of 1364	4176	UniKeyNT.exe	96
PID 4176 wrote to memory of 1364	4176	UniKeyNT.exe	96
PID 764 wrote to memory of 2824	764	0.exe	97
PID 764 wrote to memory of 2824	764	0.exe	97
PID 764 wrote to memory of 2824	764	0.exe	97

C:\Users\Admin\AppData\Local\Temp\Ransomware\Golden Eyes - via unikey.exe
"C:\Users\Admin\AppData\Local\Temp\Ransomware\Golden Eyes - via unikey.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Users\Admin\AppData\Local\Temp\is-EEHFA.tmp\Golden Eyes - via unikey.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-EEHFA.tmp\Golden Eyes - via unikey.tmp" /SL5="$60164,1108802,57344,C:\Users\Admin\AppData\Local\Temp\Ransomware\Golden Eyes - via unikey.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Program Files (x86)\UniKey\UniKeyNT.exe
    "C:\Program Files (x86)\UniKey\UniKeyNT.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4176
  - - C:\Users\Admin\AppData\Roaming\0.exe
      "C:\Users\Admin\AppData\Roaming\0.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies system executable filetype association
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:764
    - - C:\Users\Admin\AppData\Local\Temp\3582-490\0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3582-490\0.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2824
  - - C:\Users\Admin\AppData\Roaming\1.exe
      "C:\Users\Admin\AppData\Roaming\1.exe"
      4⤵
      Executes dropped EXE
      Writes to the Master Boot Record (MBR)
      Suspicious use of AdjustPrivilegeToken
      PID:1364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\UniKey\unins000.exe

Filesize
748KB

MD5
3835471d6339e16b1d025972b3a66137

SHA1
5a8d919f1e9b746333736d713886f80140be34b7

SHA256
ff888061c7ce536320384ab2ba64f19a6c8b905cd2904fadaee7fecd218c45d1

SHA512
8d72619c5f6da3c338cc0bcff1460ddaa37d6784c3349c5fc672c0d41583e0fe1d15da180748e027340d00e543dcd44847d6de89db3af569be74d5b616b68f68

Download Submit
C:\Program Files (x86)\UniKey\UniKeyNT.exe

Filesize
2.5MB

MD5
201dcd5346af5b4fb06dd80e9d7b3421

SHA1
51fd23198bec506f070190212df840c99542db63

SHA256
f48fa0c225bd5836320aa3900f9a8e09bc322c397b3947c1a24848c78563f9ac

SHA512
4954e67409be9e7edc2a75fdb34d1ecc6c077823e4003bfe2b5a63a9478fa32ceae91e5dc113fac339699b0c1bab79c0a95c93f8ce1d3b95149ab8c406fcd4f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\0.exe

Filesize
95KB

MD5
202e351d9060cfb1db2aec18dad037f3

SHA1
f78dfc3fc760d985d0cde6d97464b3eb0e61cee5

SHA256
6942eadd78446169937dfb978018835e497e71db534a65369af039dfbad6c33f

SHA512
061afba69073e7f515985ec91a314776cf09493aba9cc4772be3b0cc4188566b63425ca4597ae9884e224d08dd2370706f23507318f131dbc078ba4bbad807dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\0.exe

Filesize
428KB

MD5
ef5eed7319ab9ed99d93d1d64ea1d0a8

SHA1
91bd4e67e88ee3434be86ac93f42ed740aab3318

SHA256
9be9b130d233c4ee4a10bbf607c801dbdbe814f60d1030b314534391e2b68e88

SHA512
be115c7daf21240ab8e3989fec30bf22ab55c395b9250d0478d446776c8d3541bca0e43377eed38ceb152f50316bf34b1772c4d92273025ef6d13488bfc29aec

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-EEHFA.tmp\Golden Eyes - via unikey.tmp

Filesize
696KB

MD5
04a1b00d46a802459527119cad1fb7ae

SHA1
a922d4c13955add25b6c53bf8963331c0909a508

SHA256
4d169d681a716ef2e3645113ac48d3a8d19477c6922bc5047191a0cc60f64860

SHA512
144ddbad8d936c6d3a23ecacccea866d61ad39e471e11376077bac1c8a537a7a26b567867559d026d2aa34ab146aa1e78b5da997ac3fa07d29e24b2608534f5d

Download Submit
C:\Users\Admin\AppData\Roaming\0.exe

Filesize
468KB

MD5
d1b828691ede80adb614a8faccab8129

SHA1
f39843416ab6aa99a6050759368881e12710fa89

SHA256
f6236d5ff2545e19fa4d47c6f713cb1001b8cd8d822f76825f8ee7acbc00de1a

SHA512
86f5a4a4775a42f6526dbda3659863a2c9d09ce1ebd9d38356f3b997272262a83d3db99bc45082de4acb5d6ce7f7c3016402d7c22f0990a1c3b352d2446243ff

Download Submit
C:\Users\Admin\AppData\Roaming\1.exe

Filesize
254KB

MD5
e068ee33b5e9cb317c1af7cecc1bacb5

SHA1
ef3d2563fa3e29c1be76a149ff91398ab9987775

SHA256
b5ef16922e2c76b09edd71471dd837e89811c5e658406a8495c1364d0d9dc690

SHA512
0dbed2b5019050a84b0e3590a49a713a51ab231d73796b4754afe731690d35fdc47f04f13e29235a25f5ffcb05433c0e2e00841143a916cbb132d432cded7b10

Download Submit
memory/1364-110-0x0000000000910000-0x000000000092A000-memory.dmp

Filesize
104KB

Download
memory/1364-99-0x00000000008F0000-0x0000000000906000-memory.dmp

Filesize
88KB

Download
memory/2296-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2296-42-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2296-7-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4176-25-0x00007FFDACEF0000-0x00007FFDAD891000-memory.dmp

Filesize
9.6MB

Download
memory/4176-24-0x0000000000E10000-0x0000000000E20000-memory.dmp

Filesize
64KB

Download
memory/4176-47-0x00007FFDACEF0000-0x00007FFDAD891000-memory.dmp

Filesize
9.6MB

Download
memory/4176-23-0x00007FFDACEF0000-0x00007FFDAD891000-memory.dmp

Filesize
9.6MB

Download
memory/4912-8-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/4912-32-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/4912-5-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download