metasploit | d070ca0aad392b84d0765d02c8ae9124a06b029e0c61bfa72a3049c465722d3e

Analysis

max time kernel
140s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2024 12:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d070ca0aad392b84d0765d02c8ae9124a06b029e0c61bfa72a3049c465722d3e.exe
Size

7.6MB
MD5

29f6695de9a9d09b91db6ab4574e1174
SHA1

c79235a3e4c00f97cf0194baad720f03fc765602
SHA256

d070ca0aad392b84d0765d02c8ae9124a06b029e0c61bfa72a3049c465722d3e
SHA512

520ab61f42b4e005abbfc26b58cc113dd6e84e0cd75a552a490b336b72dbfbcff1443b9370534cf99e2c6aecf5640d3bbc6fa8098bc573a91d08300a929dd006
SSDEEP

98304:ACF+OIyoWoZf1i0hUNfHBiCV2HW/E9C0hUNfHBiCV2HvNX/H0hUNfHBiCV2HvNX/:T+OIynoyjNIKEEjNYBHjNYB

Score

10^/10

metasploit backdoor discovery trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Loads dropped DLL 3 IoCs

Processes:

d070ca0aad392b84d0765d02c8ae9124a06b029e0c61bfa72a3049c465722d3e.exe

pid	process
2252	d070ca0aad392b84d0765d02c8ae9124a06b029e0c61bfa72a3049c465722d3e.exe
2252	d070ca0aad392b84d0765d02c8ae9124a06b029e0c61bfa72a3049c465722d3e.exe
2252	d070ca0aad392b84d0765d02c8ae9124a06b029e0c61bfa72a3049c465722d3e.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

d070ca0aad392b84d0765d02c8ae9124a06b029e0c61bfa72a3049c465722d3e.exe

pid	process
2252	d070ca0aad392b84d0765d02c8ae9124a06b029e0c61bfa72a3049c465722d3e.exe
2252	d070ca0aad392b84d0765d02c8ae9124a06b029e0c61bfa72a3049c465722d3e.exe
2252	d070ca0aad392b84d0765d02c8ae9124a06b029e0c61bfa72a3049c465722d3e.exe
2252	d070ca0aad392b84d0765d02c8ae9124a06b029e0c61bfa72a3049c465722d3e.exe
2252	d070ca0aad392b84d0765d02c8ae9124a06b029e0c61bfa72a3049c465722d3e.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

d070ca0aad392b84d0765d02c8ae9124a06b029e0c61bfa72a3049c465722d3e.exe

description	pid	process
Token: SeDebugPrivilege	2252	d070ca0aad392b84d0765d02c8ae9124a06b029e0c61bfa72a3049c465722d3e.exe
Token: SeShutdownPrivilege	2252	d070ca0aad392b84d0765d02c8ae9124a06b029e0c61bfa72a3049c465722d3e.exe
Token: SeCreatePagefilePrivilege	2252	d070ca0aad392b84d0765d02c8ae9124a06b029e0c61bfa72a3049c465722d3e.exe

C:\Users\Admin\AppData\Local\Temp\d070ca0aad392b84d0765d02c8ae9124a06b029e0c61bfa72a3049c465722d3e.exe
"C:\Users\Admin\AppData\Local\Temp\d070ca0aad392b84d0765d02c8ae9124a06b029e0c61bfa72a3049c465722d3e.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:2756

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Setup\ds.dll
Filesize
67KB

MD5
7d5d3e2fcfa5ff53f5ae075ed4327b18

SHA1
3905104d8f7ba88b3b34f4997f3948b3183953f6

SHA256
e1fb95609f2757ce74cb531a5cf59674e411ea0a262b758371d7236c191910c4

SHA512
e67683331bb32ea4b2c38405be7f516db6935f883a1e4ae02a1700f5f36462c31b593e07c6fe06d8c0cb1c20c9f40a507c9eae245667c89f989e32765a89f589

Download Submit
memory/2252-22-0x0000000072CEE000-0x0000000072CEF000-memory.dmp

Filesize
4KB

Download
memory/2252-2-0x0000000002BE0000-0x0000000002C11000-memory.dmp

Filesize
196KB

Download
memory/2252-27-0x0000000073590000-0x00000000735A4000-memory.dmp

Filesize
80KB

Download
memory/2252-28-0x0000000008AF0000-0x0000000009094000-memory.dmp

Filesize
5.6MB

Download
memory/2252-5-0x0000000002C60000-0x0000000002C91000-memory.dmp

Filesize
196KB

Download
memory/2252-4-0x0000000002BE0000-0x0000000002C11000-memory.dmp

Filesize
196KB

Download
memory/2252-21-0x0000000006650000-0x0000000006660000-memory.dmp

Filesize
64KB

Download
memory/2252-0-0x0000000000400000-0x0000000000BAA0A8-memory.dmp

Filesize
7.7MB

Download
memory/2252-35-0x0000000072CEE000-0x0000000072CEF000-memory.dmp

Filesize
4KB

Download
memory/2252-3-0x0000000002BE0000-0x0000000002C11000-memory.dmp

Filesize
196KB

Download
memory/2252-1-0x0000000002BE0000-0x0000000002C11000-memory.dmp

Filesize
196KB

Download
memory/2252-29-0x0000000009100000-0x0000000009192000-memory.dmp

Filesize
584KB

Download
memory/2252-30-0x0000000009F40000-0x0000000009F84000-memory.dmp

Filesize
272KB

Download
memory/2252-31-0x0000000009F90000-0x000000000A02C000-memory.dmp

Filesize
624KB

Download
memory/2252-32-0x00000000092F0000-0x0000000009356000-memory.dmp

Filesize
408KB

Download
memory/2252-33-0x000000000A070000-0x000000000A59C000-memory.dmp

Filesize
5.2MB

Download
memory/2252-34-0x0000000006650000-0x0000000006660000-memory.dmp

Filesize
64KB

Download
memory/2252-26-0x0000000008AB0000-0x0000000008AC4000-memory.dmp

Filesize
80KB

Download