Analysis
-
max time kernel
192s -
max time network
203s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-06-2022 19:17
Static task
static1
Behavioral task
behavioral1
Sample
2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe
Resource
win10v2004-20220414-en
General
-
Target
2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe
-
Size
80KB
-
MD5
607575be3135d1b617a5b2dddb884b19
-
SHA1
ac5ba76759290781374b7cb3007abec289ff12a0
-
SHA256
2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319
-
SHA512
deabfb343e9f4dc18344ff2a7a2db0c778e0e41b5cf269b1a2cb52ac3146d7fe60cb33bccbe89b248fda78ed67ebc0eef89b53f990484856a6587c60a82a3046
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
suricata: ET MALWARE IRC Nick change on non-standard port
suricata: ET MALWARE IRC Nick change on non-standard port
-
suricata: ET MALWARE Likely Bot Nick in IRC (USA +..)
suricata: ET MALWARE Likely Bot Nick in IRC (USA +..)
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft Driver Setup = "C:\\Windows\\system32\\shmt.exe" 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe -
Executes dropped EXE 2 IoCs
Processes:
shmt.exeshmt.exepid process 2132 shmt.exe 2160 shmt.exe -
Processes:
resource yara_rule behavioral2/memory/4984-130-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4984-133-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4984-138-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\Windows\SysWOW64\shmt.exe upx C:\Windows\SysWOW64\shmt.exe upx behavioral2/memory/2132-145-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\Windows\SysWOW64\shmt.exe upx behavioral2/memory/2132-150-0x0000000000400000-0x000000000043A000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Driver Setup = "C:\\Windows\\system32\\shmt.exe" 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe -
Drops file in System32 directory 4 IoCs
Processes:
shmt.exe2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exedescription ioc process File opened for modification C:\Windows\SysWOW64\shmt.exe shmt.exe File created C:\Windows\SysWOW64\shmt.exe shmt.exe File created C:\Windows\SysWOW64\shmt.exe 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe File opened for modification C:\Windows\SysWOW64\shmt.exe 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exeshmt.exedescription pid process target process PID 4984 set thread context of 4988 4984 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe PID 2132 set thread context of 2160 2132 shmt.exe shmt.exe -
Drops file in Windows directory 1 IoCs
Processes:
shmt.exedescription ioc process File created C:\Windows\logfile32.txt shmt.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exeshmt.exepid process 4988 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 4988 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 4988 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 4988 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 4988 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 4988 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 4988 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 4988 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 2160 shmt.exe 2160 shmt.exe 4988 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 4988 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 4988 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 4988 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 4988 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 4988 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 4988 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 4988 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 4988 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 4988 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 4988 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 4988 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 4988 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 4988 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 4988 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 4988 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 4988 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 4988 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 4988 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 4988 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 4988 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 4988 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exeshmt.exedescription pid process Token: SeDebugPrivilege 4988 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe Token: SeDebugPrivilege 2160 shmt.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exeshmt.exepid process 4984 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 2132 shmt.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exeshmt.exedescription pid process target process PID 4984 wrote to memory of 4988 4984 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe PID 4984 wrote to memory of 4988 4984 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe PID 4984 wrote to memory of 4988 4984 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe PID 4984 wrote to memory of 4988 4984 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe PID 4984 wrote to memory of 4988 4984 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe PID 4984 wrote to memory of 4988 4984 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe PID 4984 wrote to memory of 4988 4984 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe PID 4984 wrote to memory of 4988 4984 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe PID 4988 wrote to memory of 2132 4988 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe shmt.exe PID 4988 wrote to memory of 2132 4988 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe shmt.exe PID 4988 wrote to memory of 2132 4988 2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe shmt.exe PID 2132 wrote to memory of 2160 2132 shmt.exe shmt.exe PID 2132 wrote to memory of 2160 2132 shmt.exe shmt.exe PID 2132 wrote to memory of 2160 2132 shmt.exe shmt.exe PID 2132 wrote to memory of 2160 2132 shmt.exe shmt.exe PID 2132 wrote to memory of 2160 2132 shmt.exe shmt.exe PID 2132 wrote to memory of 2160 2132 shmt.exe shmt.exe PID 2132 wrote to memory of 2160 2132 shmt.exe shmt.exe PID 2132 wrote to memory of 2160 2132 shmt.exe shmt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe"C:\Users\Admin\AppData\Local\Temp\2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe"C:\Users\Admin\AppData\Local\Temp\2fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319.exe"2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\shmt.exe"C:\Windows\system32\shmt.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\shmt.exe"C:\Windows\SysWOW64\shmt.exe"4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\shmt.exeFilesize
80KB
MD5607575be3135d1b617a5b2dddb884b19
SHA1ac5ba76759290781374b7cb3007abec289ff12a0
SHA2562fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319
SHA512deabfb343e9f4dc18344ff2a7a2db0c778e0e41b5cf269b1a2cb52ac3146d7fe60cb33bccbe89b248fda78ed67ebc0eef89b53f990484856a6587c60a82a3046
-
C:\Windows\SysWOW64\shmt.exeFilesize
80KB
MD5607575be3135d1b617a5b2dddb884b19
SHA1ac5ba76759290781374b7cb3007abec289ff12a0
SHA2562fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319
SHA512deabfb343e9f4dc18344ff2a7a2db0c778e0e41b5cf269b1a2cb52ac3146d7fe60cb33bccbe89b248fda78ed67ebc0eef89b53f990484856a6587c60a82a3046
-
C:\Windows\SysWOW64\shmt.exeFilesize
80KB
MD5607575be3135d1b617a5b2dddb884b19
SHA1ac5ba76759290781374b7cb3007abec289ff12a0
SHA2562fb6e21a3ff9891c2cec0dd337d8e1a6eb861e5033c564c8c20eacb3c00cb319
SHA512deabfb343e9f4dc18344ff2a7a2db0c778e0e41b5cf269b1a2cb52ac3146d7fe60cb33bccbe89b248fda78ed67ebc0eef89b53f990484856a6587c60a82a3046
-
memory/2132-150-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/2132-140-0x0000000000000000-mapping.dmp
-
memory/2132-145-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/2160-146-0x0000000000000000-mapping.dmp
-
memory/2160-152-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/4984-133-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/4984-130-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/4984-138-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/4988-135-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/4988-139-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/4988-137-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/4988-134-0x0000000000000000-mapping.dmp