metasploit | 4a0c1f036df7719f32f93aefae3bafe6074b70441e15963fafbbf8ab739be609

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31-05-2024 18:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7bd23b2bafedcf6e8713e16363f92600_NeikiAnalytics.exe
Size

98KB
MD5

7bd23b2bafedcf6e8713e16363f92600
SHA1

22e039aee11fadb077562c0d8042f262c1524571
SHA256

4a0c1f036df7719f32f93aefae3bafe6074b70441e15963fafbbf8ab739be609
SHA512

43419fa101aa1d5f5c1893e9f5a5be8e0e06c809a2ec50c30663064c34fc070977fd4d90cae5b6263c3fdca337645bea4e3b4f078938d64c6826afaefa198062
SSDEEP

768:DAqvc8Ylh2G7zaaRzlKH6Z6zkEPvyV/UIuOoB7HKKnYH7i3xVYscGqMWBBVWP2m6:t6lhN7bHKafC0ImKxVnqFBmXFUzx

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

http://45.134.21.8:62/6iXe

Attributes

headers User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUSMSCOM)

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

3596 reg.exe

pid	process
3596	reg.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

7bd23b2bafedcf6e8713e16363f92600_NeikiAnalytics.execmd.exe

description	pid	process	target process
PID 768 wrote to memory of 1160	768	7bd23b2bafedcf6e8713e16363f92600_NeikiAnalytics.exe	cmd.exe
PID 768 wrote to memory of 1160	768	7bd23b2bafedcf6e8713e16363f92600_NeikiAnalytics.exe	cmd.exe
PID 768 wrote to memory of 1160	768	7bd23b2bafedcf6e8713e16363f92600_NeikiAnalytics.exe	cmd.exe
PID 1160 wrote to memory of 3596	1160	cmd.exe	reg.exe
PID 1160 wrote to memory of 3596	1160	cmd.exe	reg.exe
PID 1160 wrote to memory of 3596	1160	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\7bd23b2bafedcf6e8713e16363f92600_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7bd23b2bafedcf6e8713e16363f92600_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:768

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set GBOxKoxZprki=7295 & reg add HKCU\SOFTWARE\zBWLazPouyCc /v yZxdMmHPRHarSfP /t REG_DWORD /d 15960 & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:1160

C:\Windows\SysWOW64\reg.exe
reg add HKCU\SOFTWARE\zBWLazPouyCc /v yZxdMmHPRHarSfP /t REG_DWORD /d 15960
3⤵
- Modifies registry key
PID:3596

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/768-0-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/768-1-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download