metasploit | 328cd97394fc1bdd4f7ff410d4617313fa86f7378fe8c31c9dc1b2ef7fa4ad75

Analysis

max time kernel
4s
max time network
0s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-06-2024 20:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

328cd97394fc1bdd4f7ff410d4617313fa86f7378fe8c31c9dc1b2ef7fa4ad75.exe
Size

255KB
MD5

31264aee72db89daba8014e491e3e8c9
SHA1

8a301f56d5952e8504ac955385a572bc34d0987f
SHA256

328cd97394fc1bdd4f7ff410d4617313fa86f7378fe8c31c9dc1b2ef7fa4ad75
SHA512

11a688aa66a36fefd7054efbb3a95a7b38dc601f48214b87a1aa83d88d61578b3a938c97c2150352f2834bde6a1cddaf4a70609c3ce84d405f05abac90aef857
SSDEEP

3072:fTAjnioLO7WpLyLNZ45OlTZHiKb8ljJ3ijAviJcfM698RyOiy12KJ3qi4YgTl:f6nrD0ZvRcjcOiJ+98X2sfXg

Score

10^/10

metasploit backdoor bootkit persistence trojan

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Auto-generated rule 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\{f76cdf95-8986-45ec-83a1-172a6599c6a2}\mmc.exe	GoldenEyeRansomware_Dropper_MalformedZoomit

Detects Reflective DLL injection artifacts 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1712-3-0x0000000000260000-0x000000000027A000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/memory/1632-14-0x0000000000250000-0x000000000026A000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Executes dropped EXE 1 IoCs

Processes:

mmc.exe

pid process

1632 mmc.exe
Loads dropped DLL 1 IoCs

Processes:

328cd97394fc1bdd4f7ff410d4617313fa86f7378fe8c31c9dc1b2ef7fa4ad75.exe

pid process

1712 328cd97394fc1bdd4f7ff410d4617313fa86f7378fe8c31c9dc1b2ef7fa4ad75.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

mmc.exe

description ioc process

File opened for modification \??\PhysicalDrive0 mmc.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

mmc.exe

description pid process

Token: SeShutdownPrivilege 1632 mmc.exe

pid	process
1632	mmc.exe

pid	process
1712	328cd97394fc1bdd4f7ff410d4617313fa86f7378fe8c31c9dc1b2ef7fa4ad75.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	mmc.exe

description	pid	process
Token: SeShutdownPrivilege	1632	mmc.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

328cd97394fc1bdd4f7ff410d4617313fa86f7378fe8c31c9dc1b2ef7fa4ad75.exe

description	pid	process	target process
PID 1712 wrote to memory of 1632	1712	328cd97394fc1bdd4f7ff410d4617313fa86f7378fe8c31c9dc1b2ef7fa4ad75.exe	mmc.exe
PID 1712 wrote to memory of 1632	1712	328cd97394fc1bdd4f7ff410d4617313fa86f7378fe8c31c9dc1b2ef7fa4ad75.exe	mmc.exe
PID 1712 wrote to memory of 1632	1712	328cd97394fc1bdd4f7ff410d4617313fa86f7378fe8c31c9dc1b2ef7fa4ad75.exe	mmc.exe
PID 1712 wrote to memory of 1632	1712	328cd97394fc1bdd4f7ff410d4617313fa86f7378fe8c31c9dc1b2ef7fa4ad75.exe	mmc.exe

C:\Users\Admin\AppData\Local\Temp\328cd97394fc1bdd4f7ff410d4617313fa86f7378fe8c31c9dc1b2ef7fa4ad75.exe
"C:\Users\Admin\AppData\Local\Temp\328cd97394fc1bdd4f7ff410d4617313fa86f7378fe8c31c9dc1b2ef7fa4ad75.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1712

C:\Users\Admin\AppData\Roaming\{f76cdf95-8986-45ec-83a1-172a6599c6a2}\mmc.exe
"C:\Users\Admin\AppData\Roaming\{f76cdf95-8986-45ec-83a1-172a6599c6a2}\mmc.exe"
2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
PID:1632

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\{f76cdf95-8986-45ec-83a1-172a6599c6a2}\mmc.exe
Filesize
255KB

MD5
31264aee72db89daba8014e491e3e8c9

SHA1
8a301f56d5952e8504ac955385a572bc34d0987f

SHA256
328cd97394fc1bdd4f7ff410d4617313fa86f7378fe8c31c9dc1b2ef7fa4ad75

SHA512
11a688aa66a36fefd7054efbb3a95a7b38dc601f48214b87a1aa83d88d61578b3a938c97c2150352f2834bde6a1cddaf4a70609c3ce84d405f05abac90aef857

Download Submit
memory/1632-13-0x0000000000230000-0x0000000000246000-memory.dmp

Filesize
88KB

Download
memory/1632-14-0x0000000000250000-0x000000000026A000-memory.dmp

Filesize
104KB

Download
memory/1712-0-0x0000000000230000-0x0000000000246000-memory.dmp

Filesize
88KB

Download
memory/1712-3-0x0000000000260000-0x000000000027A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads