metasploit | 99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313

General

Target

99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe
Size

1.8MB
MD5

05b9b7d61df1c706cc61ddcdb6be8ed9
SHA1

7b3e2ea45f214f1eb8a2e5a5e7ec8d76ba22d906
SHA256

99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313
SHA512

68bb317a72c0801efff59d5fe71a85064e0107f5948fa32352d9f9db1e672c7d574ab713dcf48a3ed3bfa2d747e3f998bb4b996efe24ccaa36a98a8b34088c68
SSDEEP

24576:/3vLRdVhZBK8NogWYO09zOGi9J3YiWdCMJ5QxmjwC/hR:/3d5ZQ15xJIiW0MbQxA

Score

10^/10

metasploit backdoor discovery spyware stealer trojan

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

C2

1.15.12.73:4567

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Drops file in Drivers directory 1 IoCs

Processes:

99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe

description	ioc	process
File opened (read-only)	\??\O:	99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe
File opened (read-only)	\??\S:	99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe
File opened (read-only)	\??\T:	99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe
File opened (read-only)	\??\Y:	99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe
File opened (read-only)	\??\K:	99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe
File opened (read-only)	\??\L:	99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe
File opened (read-only)	\??\V:	99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe
File opened (read-only)	\??\Z:	99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe
File opened (read-only)	\??\J:	99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe
File opened (read-only)	\??\I:	99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe
File opened (read-only)	\??\M:	99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe
File opened (read-only)	\??\P:	99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe
File opened (read-only)	\??\R:	99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe
File opened (read-only)	\??\B:	99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe
File opened (read-only)	\??\E:	99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe
File opened (read-only)	\??\G:	99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe
File opened (read-only)	\??\H:	99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe
File opened (read-only)	\??\N:	99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe
File opened (read-only)	\??\Q:	99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe
File opened (read-only)	\??\U:	99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe
File opened (read-only)	\??\W:	99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe
File opened (read-only)	\??\A:	99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe
File opened (read-only)	\??\X:	99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe

description	pid	process
Token: SeDebugPrivilege	864	99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe
Token: SeDebugPrivilege	864	99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe
Token: SeDebugPrivilege	2108	99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe
Token: SeDebugPrivilege	2108	99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe

description	pid	process	target process
PID 864 wrote to memory of 2108	864	99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe	99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe
PID 864 wrote to memory of 2108	864	99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe	99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe
PID 864 wrote to memory of 2108	864	99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe	99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe

C:\Users\Admin\AppData\Local\Temp\99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe
"C:\Users\Admin\AppData\Local\Temp\99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:864

C:\Users\Admin\AppData\Local\Temp\99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe
"C:\Users\Admin\AppData\Local\Temp\99f03bc90ae5f6d166d4a0a9abd1a3a134d1395ee808b554bc6661b16f6b8313.exe" Admin
2⤵
- Drops file in Drivers directory
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:2108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1044 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/864-0-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/864-1-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/864-2-0x0000000002770000-0x0000000002771000-memory.dmp

Filesize
4KB

Download
memory/864-5-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/2108-8-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/2108-10-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/2108-11-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/2108-12-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/2108-13-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/2108-14-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/2108-15-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/2108-16-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/2108-17-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/2108-18-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/2108-19-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download
memory/2108-23-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads