metasploit | b710414e700bea5fc333e4e7c829f6187c9da871e0849e00dbf02524fae14b77

Analysis

max time kernel
120s
max time network
115s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
03-12-2024 15:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b710414e700bea5fc333e4e7c829f6187c9da871e0849e00dbf02524fae14b77N.exe
Size

3.4MB
MD5

c4866c38facc867a94cd45f263f95370
SHA1

a0ca19a9f20662592e4b2c89423d4b366d32f3dd
SHA256

b710414e700bea5fc333e4e7c829f6187c9da871e0849e00dbf02524fae14b77
SHA512

cc3938f5de34f274ed0c0b213de440af46284a39558f6a31f8e3aff412b34dc1a68f906ba5a3061bd1ef6d8a5a8cfbef020a7574fd8ec6730667350e232754cc
SSDEEP

98304:vP3lt6Nd8UvM1UZqTxQe2BasUCcnbHJK:n/6Q+M10qlt2ksmbHk

Score

10^/10

metasploit backdoor discovery trojan

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

147.185.221.24:7313

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Loads dropped DLL 3 IoCs

pid	Process
2628	b710414e700bea5fc333e4e7c829f6187c9da871e0849e00dbf02524fae14b77N.exe
2628	b710414e700bea5fc333e4e7c829f6187c9da871e0849e00dbf02524fae14b77N.exe
2628	b710414e700bea5fc333e4e7c829f6187c9da871e0849e00dbf02524fae14b77N.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b710414e700bea5fc333e4e7c829f6187c9da871e0849e00dbf02524fae14b77N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b710414e700bea5fc333e4e7c829f6187c9da871e0849e00dbf02524fae14b77N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2628	2652	b710414e700bea5fc333e4e7c829f6187c9da871e0849e00dbf02524fae14b77N.exe	31
PID 2652 wrote to memory of 2628	2652	b710414e700bea5fc333e4e7c829f6187c9da871e0849e00dbf02524fae14b77N.exe	31
PID 2652 wrote to memory of 2628	2652	b710414e700bea5fc333e4e7c829f6187c9da871e0849e00dbf02524fae14b77N.exe	31
PID 2652 wrote to memory of 2628	2652	b710414e700bea5fc333e4e7c829f6187c9da871e0849e00dbf02524fae14b77N.exe	31

C:\Users\Admin\AppData\Local\Temp\b710414e700bea5fc333e4e7c829f6187c9da871e0849e00dbf02524fae14b77N.exe
"C:\Users\Admin\AppData\Local\Temp\b710414e700bea5fc333e4e7c829f6187c9da871e0849e00dbf02524fae14b77N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Users\Admin\AppData\Local\Temp\b710414e700bea5fc333e4e7c829f6187c9da871e0849e00dbf02524fae14b77N.exe
  "C:\Users\Admin\AppData\Local\Temp\b710414e700bea5fc333e4e7c829f6187c9da871e0849e00dbf02524fae14b77N.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI26522\MSVCR90.dll

Filesize
638KB

MD5
45d3b9d724af0b8eb85d4927d6c666ff

SHA1
fba91a83b1f4e7748cb6e71060a9db9d57afbcc3

SHA256
1bb6e583834aa5ab413ab591627c5fbc56851754dd058bd4db074c1399b77cbc

SHA512
2f8be77991376234d87bc00590fc4e72d408a7b71e7d03f5afe0f82de630f86fbad745d110b1add8755117672be897581d7bfc7ab40bdf1bb890006c6e3a5056

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26522\VBmeta.exe.manifest

Filesize
1KB

MD5
be157afdbf92b4d62af02484504782c0

SHA1
69aadf86d68b6ad028bbd5e5df82f8e12f5e3fd6

SHA256
adbcb1b72dc35c4c1923f07397d1afb7d550340408a20a16f9bb1f79c065cd70

SHA512
9204fc9f6b7d2273f393fbc1564b0b7ba12a4ca1567d30b7da006eace13542149bd26121740b1cc830ce0277dcea45c26de014b71b34847df00cbcff94adfa12

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26522\python27.dll

Filesize
2.5MB

MD5
0885762afdd26e02e0008ea6e1dd71af

SHA1
6761ec7b9c1e2210fe22126a53261e125099b814

SHA256
56e06c332f6d1a33efab1117a8866234187e5833f240813721b22ee01f2818aa

SHA512
653c3ce3016f27c0aff7d285ff599154e703c9578d37d42cfe7dff3a0584e2d38851038fc48ea1b2035ba01cf5474eacf3fd1b05379aaa9b0e078d58c67cb6bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26~1\_ctypes.pyd

Filesize
90KB

MD5
6daf8b55801a602f84d7d568a142459c

SHA1
57a80ca9621b282727d45caa5ae1c5e3c7e93f60

SHA256
66d0cb13569e9798b04c5d049cff25bd4c7c8e7ddd885b62f523d90a65d0ce88

SHA512
abb1c17aea3edb46c096ca3d8cbf74c9dccad36a7b83be8cf30697760ad49f3bd3a38dc4ff1f0b715ad7996c3a23ea1c855fffd62af01d15935abc73378dcc2e

Download Submit
memory/2628-18-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download