Overview

overview

10

Static

static

8

65d073da0d...61.doc

windows7-x64

10

65d073da0d...61.doc

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    65d073da0d265b9b8e4f4284e7850af051908289158877168214cf25e3bc8461

  • Size

    43KB

  • Sample

    240530-bw3dmaae79

  • MD5

    ce9d441c46ef4168488bb38148974c33

  • SHA1

    d5b1a13e8be4b770fabcf4278d5adf69b1562a0d

  • SHA256

    65d073da0d265b9b8e4f4284e7850af051908289158877168214cf25e3bc8461

  • SHA512

    c737b91150d5608bba2abd7c8bb829ec870d4aba249e61b2b213cd51b682558c3de2bd5864f49549dc0b2397264616ae43ff8d638252222d4b45dfb35d4d728b

  • SSDEEP

    384:Cg8iSwvxjk+txZEF+pek/iEVd8sfR3rGscsd71I5KA0j4/ItSzY:CGxw+t4F+pekq6d/fhrGsceIZ3/nY

Score
10/10
metasploitbackdoormacromacro_on_actiontrojan

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://10.10.10.10:80/oEXP

Attributes
  • headers User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUS)

Targets

    • Target

      65d073da0d265b9b8e4f4284e7850af051908289158877168214cf25e3bc8461

    • Size

      43KB

    • MD5

      ce9d441c46ef4168488bb38148974c33

    • SHA1

      d5b1a13e8be4b770fabcf4278d5adf69b1562a0d

    • SHA256

      65d073da0d265b9b8e4f4284e7850af051908289158877168214cf25e3bc8461

    • SHA512

      c737b91150d5608bba2abd7c8bb829ec870d4aba249e61b2b213cd51b682558c3de2bd5864f49549dc0b2397264616ae43ff8d638252222d4b45dfb35d4d728b

    • SSDEEP

      384:Cg8iSwvxjk+txZEF+pek/iEVd8sfR3rGscsd71I5KA0j4/ItSzY:CGxw+t4F+pekq6d/fhrGsceIZ3/nY

    Score
    10/10
    metasploitbackdoortrojan

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks