metasploit | 858415220041b72086f6c8282779b65ac05c7936e4d252400c684fa70d020e41

General

Target

1.ps1
Size

2KB
MD5

0872c54372986ab2d2c6afbbd8a59a9c
SHA1

ed968d3c88b76479c0f3b5b4da9f83d9649cb256
SHA256

858415220041b72086f6c8282779b65ac05c7936e4d252400c684fa70d020e41
SHA512

9632d3879ccac093e215bcaa6c204ea83d2086c816b1c8fe859770441451f350401479e1a31cf6603a4c71a64f7bedcba1213c0a1d8745387a73b46dd2209d77

Score

10^/10

metasploit backdoor execution trojan

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

10.254.66.59:8888

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4536	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4536	powershell.exe
4536	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4536	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 5360	4536	powershell.exe	87
PID 4536 wrote to memory of 5360	4536	powershell.exe	87
PID 5360 wrote to memory of 4804	5360	csc.exe	88
PID 5360 wrote to memory of 4804	5360	csc.exe	88

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\1.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yrx5tznl\yrx5tznl.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5360
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8656.tmp" "c:\Users\Admin\AppData\Local\Temp\yrx5tznl\CSCA010A42EFDFB480E9CABD7EA9A2ADEF7.TMP"
    3⤵
    PID:4804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES8656.tmp

Filesize
1KB

MD5
7fe9008fd2cb89d78f8ca8b79787fb25

SHA1
8fbe122b8606015b5a117cea188e2783f9da1880

SHA256
7736fed559a303f4b904e5a8153c0026fc30d0d64c2831b88d6233ed3a30a9fd

SHA512
cf05cbfb7538a06166981ed163cd9ec3a1a4cb8aa70ce8c78b6288a2ec8a1a4e25805193a3372f08024dce5cf41be7c8e50582aaa499281a61f8739fdc42c9f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a3400l3i.5yb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\yrx5tznl\yrx5tznl.dll

Filesize
3KB

MD5
db27b80a5b1dd26e042763dde07e483d

SHA1
a99b52511a703e38412abc6dfa8644ab04ad26a4

SHA256
ed831ac900d7ec61a6a2efa16cf0a9461af52e4fa5ccf749e522302c95e66ab1

SHA512
70fa43f6c5438c716528fc1349c59c3508d95ff4012f105c57ec53ef9fc3d5ab17e594c45f52a48f5a36d8894d8708b220390298060fad4dd76e586ecb64f84e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\yrx5tznl\CSCA010A42EFDFB480E9CABD7EA9A2ADEF7.TMP

Filesize
652B

MD5
2947d9859be0876ef9733a61e667cbeb

SHA1
7fdfc7156a84177d229c76059b6dd9a317c70c9c

SHA256
f801313b9129d4d482d73f0cf9e6b3ca84aab695ae19abb0c7dd7cc4b588b754

SHA512
511607ed8a6d4c82717e5feb25c8412caa6666d1d9023a9bfbd9557f1cb05bad98d491f82d7323951ffd45f8981ce0c836a3b769aad5d746040a091532b0d567

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\yrx5tznl\yrx5tznl.0.cs

Filesize
468B

MD5
52cc39367c8ed123b15e831e52cbd25f

SHA1
497593af41731aedd939d2234d8d117c57a6d726

SHA256
5a67bcd5871f71a78abf1da47c3529617f34b47a5ab7bde0f1133a33fa751012

SHA512
ce6b89a38b94543b6461b5ecc01054c518a6e0daa4962e249a694db198b15602e716098868322eb8275a09d936b4ef3c0242089800bac0ab1926c8bb38d78fcc

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\yrx5tznl\yrx5tznl.cmdline

Filesize
369B

MD5
a0830b5ad580bb2358b2683aa1702b28

SHA1
c15d948519804acfecd1247eca26568c9a911bcb

SHA256
c405fc111112f97aad60c76a43851d9a0ea3da6bc1b30c8f9512b935db157b04

SHA512
7313b552e433ea7cd0fac36217dd78372b22fa3660bc81bd15b5537e849165c944b600db3f1141754af16065f2489692424cc64e142de30b139c2f9eefb19362

Download Submit
memory/4536-0-0x00007FFC921E3000-0x00007FFC921E5000-memory.dmp

Filesize
8KB

Download
memory/4536-12-0x00007FFC921E0000-0x00007FFC92CA1000-memory.dmp

Filesize
10.8MB

Download
memory/4536-25-0x000002BB797B0000-0x000002BB797B8000-memory.dmp

Filesize
32KB

Download
memory/4536-11-0x00007FFC921E0000-0x00007FFC92CA1000-memory.dmp

Filesize
10.8MB

Download
memory/4536-31-0x00007FFC921E0000-0x00007FFC92CA1000-memory.dmp

Filesize
10.8MB

Download
memory/4536-27-0x000002BB797C0000-0x000002BB797C1000-memory.dmp

Filesize
4KB

Download
memory/4536-32-0x00007FFC921E0000-0x00007FFC92CA1000-memory.dmp

Filesize
10.8MB

Download
memory/4536-3-0x000002BB773D0000-0x000002BB773F2000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing