metasploit | 82fbb67bf03714661b75a49245c8fe42141e7b68dda3f97f765eb1f2e00a89a9

Resubmissions

09-04-2024 07:01

240409-htps3scd2w 10

09-04-2024 07:01

09-04-2024 07:00

09-04-2024 07:00

07-03-2024 22:29

Analysis

max time kernel
2s
max time network
54s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
09-04-2024 07:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

New Text Document mod.exe
Size

8KB
MD5

69994ff2f00eeca9335ccd502198e05b
SHA1

b13a15a5bea65b711b835ce8eccd2a699a99cead
SHA256

2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
SHA512

ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3
SSDEEP

96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1

Score

10^/10

metasploit redline zgrat 6077866846 backdoor infostealer rat themida trojan

Malware Config

Extracted

Family

redline

Botnet

6077866846

https://pastebin.com/raw/KE5Mft0T

Extracted

Family

metasploit

Version

metasploit_stager

91.92.247.21:8405

Signatures

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral4/memory/3516-126-0x000001E56FE20000-0x000001E570096000-memory.dmp	family_zgrat_v1

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral4/memory/1960-39-0x00000000006A0000-0x00000000006C2000-memory.dmp	family_redline

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Downloads MZ/PE file

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe	themida
behavioral4/memory/3576-83-0x00000000009E0000-0x0000000001AFC000-memory.dmp	themida
behavioral4/memory/3576-86-0x00000000009E0000-0x0000000001AFC000-memory.dmp	themida

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

4 raw.githubusercontent.com
6 raw.githubusercontent.com

flow	ioc
4	raw.githubusercontent.com
6	raw.githubusercontent.com

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\a\wininit.exe	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

New Text Document mod.exe

description pid process

Token: SeDebugPrivilege 3256 New Text Document mod.exe

description	pid	process
Token: SeDebugPrivilege	3256	New Text Document mod.exe

C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe
"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3256

C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe
"C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe"
2⤵
PID:3576

C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe
"C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe"
2⤵
PID:3024

C:\Users\Admin\AppData\Local\Temp\jdQnoKbJ.exe
"C:\Users\Admin\AppData\Local\Temp\jdQnoKbJ.exe"
3⤵
PID:1068

C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe
"C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"
2⤵
PID:1960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=crypted6077866846MVYQY.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
3⤵
PID:1236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xdc,0x110,0x7ffde7b63cb8,0x7ffde7b63cc8,0x7ffde7b63cd8
4⤵
PID:4264

C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe
"C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"
2⤵
PID:1056

C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe
"C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe"
2⤵
PID:1268

C:\Users\Admin\AppData\Local\Temp\a\pclient.exe
"C:\Users\Admin\AppData\Local\Temp\a\pclient.exe"
2⤵
PID:4112

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
3⤵
PID:3516

C:\Users\Admin\AppData\Local\Temp\a\MStore.exe
"C:\Users\Admin\AppData\Local\Temp\a\MStore.exe"
2⤵
PID:3280

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c powershell Add-MpPreference -ExclusionExtension .exe
3⤵
PID:1968

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionExtension .exe
4⤵
PID:3084

C:\Users\Admin\AppData\Local\Temp\a\Props.exe
"C:\Users\Admin\AppData\Local\Temp\a\Props.exe"
2⤵
PID:4780

C:\Users\Admin\AppData\Local\Temp\a\wininit.exe
"C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"
2⤵
PID:4840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f2dc80f5403feb8461b7ffa09890d6a0

SHA1
d5b61e6d672e7e71571e0132e21cead181da8805

SHA256
eadeadba37eed18e5acba408d7e076270b00403fed372b77164577232232428a

SHA512
5e2119529b99b76be105c43714e4b9977ee2147172c1c44e92bd9b41fa7a66f55d4073c864aac668a912aff2898bd216fb38f2fe34ef65de69ad12965218caf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe

Filesize
6KB

MD5
f7930c4859ccd34bd2b80a9995f49926

SHA1
8b5b95fb51619e20246f90d60f2137da7654fc5e

SHA256
163969ebee8180e125eb00c02307adda1eb31174ba6f7e011b7b4b3441d8950a

SHA512
8f5a440541b227083f3d2a3a251758bf699a290db3c066ae3209d4c2df5e1e933b9c24cd4c0da0a7f3cb6ca0ce025acf22f65cc06ee1e306ecb9b1318a223a43

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0m13c33c.ljc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\MStore.exe

Filesize
12KB

MD5
282c1ebb16ad0edc41389d1e73a74607

SHA1
fbcdda121484ea6125827ed4e7b1b00f6a88835d

SHA256
7712424f2dec2d08630237c737e5f81789d2e92edc31111c72eaa0388b6df1dc

SHA512
94be4f173c5c63947a6e7902a86c8851ee84a06d1ddec104af91592178adafc3180f652791badc3e0c1139bbc7c9f64b9e47ccd0adadd16159a40ab6c188b292

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\Props.exe

Filesize
7KB

MD5
9c938f91a0530150a2b1c4546334570c

SHA1
f4ae9acba920744457739fef0205f86443dbdf65

SHA256
35a6319c334d545be1aff625c27d51d583762b44c77f172f532c27021459345a

SHA512
f5b8fa5f95011fe6677f2f751b5364745607a027e49de05d2a11a5bea5040c97b6cb4285007ee34ce05b00217dd9665065b276df21bf37f823691f57ad2a6a0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe

Filesize
524KB

MD5
c8edf453ed433cefb2696bb859e0f782

SHA1
e34cf939d6c5a34c7bedfd885249bb7fb15336e5

SHA256
0c5c2b10c3161ad9452c25d4a10e082ec94f0eb39b583c03ab3534a5e45649a0

SHA512
61d0ba50f9678d6614e4d8ab8b06d759891979e0debfda88246871ee110a07c16ceeed4e7baec475b4b63de851bc5d62c69c5ae41674ffc207b94515f6ab197c

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe

Filesize
294KB

MD5
10fc8b2915c43aa16b6a2e2b4529adc5

SHA1
0c15286457963eb86d61d83642870a3473ef38fe

SHA256
feb09cc39b1520d228e9e9274500b8c229016d6fc8018a2bf19aa9d3601492c5

SHA512
421631c06408c3be522953459228d2e1d45eeeafce29dba7746c8485a105b59c3a2c0d9e2ffc6d89126cd825ffd09ebe7eb82223a69d1f5caf441feb01e57897

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe

Filesize
2.3MB

MD5
262a7eb58a01d1aab21b24292c181cd3

SHA1
535312b7048fb90be981e04ea759c5ad8aaf6eda

SHA256
107090a44888272297ecb7a715a9abca4bc17dafe6aa57505436722a5a9926a6

SHA512
358b34a792eadc739446283e42a352147aac1bad6d9a535eedabeb2427735b03e7977d25086cfa6b6e8e17df628e37d9a8cd584dd1a64d703e99a8f7af1a0e9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe

Filesize
7.7MB

MD5
7aca152e7040f43dae201cfe01ce37b4

SHA1
83eb2fa2d400f96b241e61f81e4d80317eea0200

SHA256
ce602c6700032c737e7f29dc604f3b92f4a78217b5d3970e1666aab998443c50

SHA512
84415dcc06c965ef9cf159a06e492efe37e48ce7e6c55c514ef7c17c9782ee20faeed3fc18e1517711fc83a9fa337f84c0f2a45c10d85d8b3ea826c6b5c472d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\pclient.exe

Filesize
157KB

MD5
5790d1417f8f00bd7ec6fb7011c79d9c

SHA1
36076ed9457c45d94e664ea291eb01e5c70d084b

SHA256
ad07503bc046f5b3d65eb61646fa826bc39560916c6e1ef2c3437b6465b30a82

SHA512
b19195510624ad16a4730282c97b68d05e4890a33d91f86f24eaf921e23e7786649e4e31aaaec2d9d6c7bb3695c615851d7aed3e53b13083e03acbc8d0543ef0

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\wininit.exe

Filesize
960KB

MD5
026f56562a680266f5a02c2eba2b72ca

SHA1
acd0d5c5f609452c4ae0a2289477887682460873

SHA256
4676e9a7fc49fb86d76587cd4433edf5f10f8be88511cd16e5725f519cc9cfaf

SHA512
85af2e98f6921e036f1079e54f01911d716844a944443e88158e2849f7dcadfbc04bf4feacf887b4589e70dd5cd84b790134fbc83a7c0445568d958397c798aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\wininit.exe

Filesize
128KB

MD5
cd532f9e3411107036ba2ce4c66ca2eb

SHA1
2c94dc9fafa559190239cc24eac9ac9894b47027

SHA256
f2081ddf71f7a6f35e14cde59a71145187d3b796cb27a8db9c209bb8e773e817

SHA512
750d575dec2ce74330e832064d624299133b8172fc0ab2514b39b483448904a03c1e9ffc40b1bc6e8a068bafb1989577f80c63df5fbd27e7dbb3c76f616f88de

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe

Filesize
13KB

MD5
0c550ce9bb3efa8c3ce80a507cadfffa

SHA1
6559cb9db9c13147da5139cc3b8d9c60b914b667

SHA256
0dc62bc58b6ae1a7971a73973731b6d3f23e8003280451b84623803c39a3f912

SHA512
c74d6f53192d2dbee74278e1d67f5f7912bc61283c5582fecbff5dcadf699f208dbb60e5cb8272d28a184bbb1209f8558517868e62afbad92fcec14c2a8a6bbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\jdQnoKbJ.exe

Filesize
5KB

MD5
6a2c09749219d577535d0338c6cffe06

SHA1
576b00c03455a518664308c976097097f691bca4

SHA256
75b57c1c27f33b59ab9b62dc15a2a66b0a0b28a55bdc72119edbb98a1692573c

SHA512
cd5d2269011a79e7bcdf8dfceb78e908f8bb2b6561228a25ebe3161a6194eafb6a6d79a390215e0f1d8bf04f7a2d6f26b7c532835f1187d25fa2889a84be6e0c

Download Submit
memory/1960-39-0x00000000006A0000-0x00000000006C2000-memory.dmp

Filesize
136KB

Download
memory/3084-118-0x0000023FB00E0000-0x0000023FB0102000-memory.dmp

Filesize
136KB

Download
memory/3084-120-0x0000023FAFFA0000-0x0000023FAFFB0000-memory.dmp

Filesize
64KB

Download
memory/3084-121-0x0000023FAFFA0000-0x0000023FAFFB0000-memory.dmp

Filesize
64KB

Download
memory/3084-119-0x00007FFDDB2E0000-0x00007FFDDBDA2000-memory.dmp

Filesize
10.8MB

Download
memory/3256-109-0x00007FFDDB2E0000-0x00007FFDDBDA2000-memory.dmp

Filesize
10.8MB

Download
memory/3256-0-0x00000000007F0000-0x00000000007F8000-memory.dmp

Filesize
32KB

Download
memory/3256-1-0x00007FFDDB2E0000-0x00007FFDDBDA2000-memory.dmp

Filesize
10.8MB

Download
memory/3256-2-0x000000001B440000-0x000000001B450000-memory.dmp

Filesize
64KB

Download
memory/3516-126-0x000001E56FE20000-0x000001E570096000-memory.dmp

Filesize
2.5MB

Download
memory/3516-84-0x00007FFDDB2E0000-0x00007FFDDBDA2000-memory.dmp

Filesize
10.8MB

Download
memory/3516-85-0x000001E56F3A0000-0x000001E56F3B0000-memory.dmp

Filesize
64KB

Download
memory/3516-82-0x000001E56D6C0000-0x000001E56D6C6000-memory.dmp

Filesize
24KB

Download
memory/3576-83-0x00000000009E0000-0x0000000001AFC000-memory.dmp

Filesize
17.1MB

Download
memory/3576-107-0x0000000000400000-0x000000000054E000-memory.dmp

Filesize
1.3MB

Download
memory/3576-108-0x0000000006940000-0x0000000006954000-memory.dmp

Filesize
80KB

Download
memory/3576-106-0x0000000006950000-0x000000000695A000-memory.dmp

Filesize
40KB

Download
memory/3576-54-0x0000000077396000-0x0000000077398000-memory.dmp

Filesize
8KB

Download
memory/3576-29-0x0000000076D60000-0x0000000076E50000-memory.dmp

Filesize
960KB

Download
memory/3576-24-0x0000000076D60000-0x0000000076E50000-memory.dmp

Filesize
960KB

Download
memory/3576-23-0x0000000077394000-0x0000000077395000-memory.dmp

Filesize
4KB

Download
memory/3576-88-0x00000000069C0000-0x0000000006A52000-memory.dmp

Filesize
584KB

Download
memory/3576-22-0x00000000009E0000-0x0000000001AFC000-memory.dmp

Filesize
17.1MB

Download
memory/3576-87-0x0000000006ED0000-0x0000000007476000-memory.dmp

Filesize
5.6MB

Download
memory/3576-86-0x00000000009E0000-0x0000000001AFC000-memory.dmp

Filesize
17.1MB

Download
memory/4780-104-0x0000000140000000-0x0000000140004278-memory.dmp

Filesize
16KB

Download