metasploit | 8c12a4053e0f255b184eed53afd60d9e3102cdba178dbc6b54aeffb7b58dfa45

General

Target

8c12a4053e0f255b184eed53afd60d9e3102cdba178dbc6b54aeffb7b58dfa45.exe
Size

9.8MB
MD5

110c5d49efc5eb2db0e91490728d3be9
SHA1

7fc790f7977b2e55a53d5f789d4098c71ef2025e
SHA256

8c12a4053e0f255b184eed53afd60d9e3102cdba178dbc6b54aeffb7b58dfa45
SHA512

78e5500d0b5ae36807f45912b2525df34e203c1f241702aaca5efc4167285c889fca632a2f6645afb62eef80830ff8bd2b81748cf3294eb62ac146fb448499e6
SSDEEP

196608:za4i3zQL1CW+jMZczEN7QwgV7NUuvtYTDoBu40sxRxjAkt5o9:IM5CHMyU7QwgV7+uvtYTDoAhsxRRbo9

Score

10^/10

metasploit backdoor discovery trojan

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

C2

10.84.142.252:1234

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Executes dropped EXE 1 IoCs

pid	Process
1356	8c12a4053e0f255b184eed53afd60d9e3102cdba178dbc6b54aeffb7b58dfa45.tmp

Loads dropped DLL 1 IoCs

pid	Process
2012	8c12a4053e0f255b184eed53afd60d9e3102cdba178dbc6b54aeffb7b58dfa45.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8c12a4053e0f255b184eed53afd60d9e3102cdba178dbc6b54aeffb7b58dfa45.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8c12a4053e0f255b184eed53afd60d9e3102cdba178dbc6b54aeffb7b58dfa45.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1356	2012	8c12a4053e0f255b184eed53afd60d9e3102cdba178dbc6b54aeffb7b58dfa45.exe	31
PID 2012 wrote to memory of 1356	2012	8c12a4053e0f255b184eed53afd60d9e3102cdba178dbc6b54aeffb7b58dfa45.exe	31
PID 2012 wrote to memory of 1356	2012	8c12a4053e0f255b184eed53afd60d9e3102cdba178dbc6b54aeffb7b58dfa45.exe	31
PID 2012 wrote to memory of 1356	2012	8c12a4053e0f255b184eed53afd60d9e3102cdba178dbc6b54aeffb7b58dfa45.exe	31
PID 2012 wrote to memory of 1356	2012	8c12a4053e0f255b184eed53afd60d9e3102cdba178dbc6b54aeffb7b58dfa45.exe	31
PID 2012 wrote to memory of 1356	2012	8c12a4053e0f255b184eed53afd60d9e3102cdba178dbc6b54aeffb7b58dfa45.exe	31
PID 2012 wrote to memory of 1356	2012	8c12a4053e0f255b184eed53afd60d9e3102cdba178dbc6b54aeffb7b58dfa45.exe	31

C:\Users\Admin\AppData\Local\Temp\8c12a4053e0f255b184eed53afd60d9e3102cdba178dbc6b54aeffb7b58dfa45.exe
"C:\Users\Admin\AppData\Local\Temp\8c12a4053e0f255b184eed53afd60d9e3102cdba178dbc6b54aeffb7b58dfa45.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Users\Admin\AppData\Local\Temp\is-QPTSA.tmp\8c12a4053e0f255b184eed53afd60d9e3102cdba178dbc6b54aeffb7b58dfa45.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-QPTSA.tmp\8c12a4053e0f255b184eed53afd60d9e3102cdba178dbc6b54aeffb7b58dfa45.tmp" /SL5="$40112,9469063,832512,C:\Users\Admin\AppData\Local\Temp\8c12a4053e0f255b184eed53afd60d9e3102cdba178dbc6b54aeffb7b58dfa45.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-QPTSA.tmp\8c12a4053e0f255b184eed53afd60d9e3102cdba178dbc6b54aeffb7b58dfa45.tmp

Filesize
3.1MB

MD5
b60c22298da5c99b9c165809d17a6b25

SHA1
7b0b68f4b63f0b1931e62ad2eeb0ddb4f5543b1d

SHA256
7528cd9ed88530129aecdbb962c4db242ae28a5a8abcfcea4d4a56b0288ac2d9

SHA512
85bd43cad22cf92821bc4e4a166f65ed5ed26ab7ea0f8c65233ea5d5a7151538fb29bef2d71d6fd2f1a3b99db59246cf9a08b3e645e9a0db0cfc0fe1d2648867

Download Submit
memory/1356-20-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/1356-37-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/1356-18-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/1356-39-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/1356-10-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/1356-14-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/1356-35-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/1356-22-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/1356-41-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/1356-32-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/1356-16-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/1356-24-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/1356-26-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/1356-28-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/1356-30-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2012-3-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/2012-12-0x0000000000400000-0x0000000000DE6000-memory.dmp

Filesize
9.9MB

Download
memory/2012-0-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2012-1-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2012-2-0x0000000000400000-0x0000000000DE6000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing