Analysis
-
max time kernel
171s -
max time network
169s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-07-2022 07:56
Static task
static1
Behavioral task
behavioral1
Sample
3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe
Resource
win10v2004-20220414-en
General
-
Target
3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe
-
Size
196KB
-
MD5
f9e95ae291c9d014bf6d7c035038c665
-
SHA1
2d5ce01b255c567489c218bd5cc72aa3a966fcd9
-
SHA256
3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a
-
SHA512
f44d95b5fa0295122ac894724a896db353c740169167031413bf76e469b26af02d7652e6a79aa0fb10097ca7fb4b4437277fcce08623453a3bbbe42999e72970
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
suricata: ET MALWARE IRC Nick change on non-standard port
suricata: ET MALWARE IRC Nick change on non-standard port
-
suricata: ET MALWARE Likely Bot Nick in IRC (USA +..)
suricata: ET MALWARE Likely Bot Nick in IRC (USA +..)
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft Driver Setup = "C:\\Windows\\system32\\shmt.exe" 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe -
Executes dropped EXE 2 IoCs
Processes:
shmt.exeshmt.exepid process 2032 shmt.exe 1732 shmt.exe -
Loads dropped DLL 2 IoCs
Processes:
3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exepid process 1652 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe 1652 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Driver Setup = "C:\\Windows\\system32\\shmt.exe" 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe -
Drops file in System32 directory 4 IoCs
Processes:
3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exeshmt.exedescription ioc process File created C:\Windows\SysWOW64\shmt.exe 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe File opened for modification C:\Windows\SysWOW64\shmt.exe 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe File opened for modification C:\Windows\SysWOW64\shmt.exe shmt.exe File created C:\Windows\SysWOW64\shmt.exe shmt.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exeshmt.exedescription pid process target process PID 1944 set thread context of 1652 1944 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe PID 2032 set thread context of 1732 2032 shmt.exe shmt.exe -
Drops file in Windows directory 1 IoCs
Processes:
shmt.exedescription ioc process File created C:\Windows\logfile32.txt shmt.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exeshmt.exepid process 1652 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe 1652 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe 1652 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe 1732 shmt.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exeshmt.exedescription pid process Token: SeDebugPrivilege 1652 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe Token: SeDebugPrivilege 1732 shmt.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exeshmt.exepid process 1944 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe 2032 shmt.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exeshmt.exedescription pid process target process PID 1944 wrote to memory of 1652 1944 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe PID 1944 wrote to memory of 1652 1944 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe PID 1944 wrote to memory of 1652 1944 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe PID 1944 wrote to memory of 1652 1944 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe PID 1944 wrote to memory of 1652 1944 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe PID 1944 wrote to memory of 1652 1944 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe PID 1944 wrote to memory of 1652 1944 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe PID 1944 wrote to memory of 1652 1944 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe PID 1944 wrote to memory of 1652 1944 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe PID 1652 wrote to memory of 2032 1652 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe shmt.exe PID 1652 wrote to memory of 2032 1652 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe shmt.exe PID 1652 wrote to memory of 2032 1652 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe shmt.exe PID 1652 wrote to memory of 2032 1652 3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe shmt.exe PID 2032 wrote to memory of 1732 2032 shmt.exe shmt.exe PID 2032 wrote to memory of 1732 2032 shmt.exe shmt.exe PID 2032 wrote to memory of 1732 2032 shmt.exe shmt.exe PID 2032 wrote to memory of 1732 2032 shmt.exe shmt.exe PID 2032 wrote to memory of 1732 2032 shmt.exe shmt.exe PID 2032 wrote to memory of 1732 2032 shmt.exe shmt.exe PID 2032 wrote to memory of 1732 2032 shmt.exe shmt.exe PID 2032 wrote to memory of 1732 2032 shmt.exe shmt.exe PID 2032 wrote to memory of 1732 2032 shmt.exe shmt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe"C:\Users\Admin\AppData\Local\Temp\3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe"C:\Users\Admin\AppData\Local\Temp\3c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a.exe"2⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\shmt.exe"C:\Windows\system32\shmt.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\shmt.exe"C:\Windows\SysWOW64\shmt.exe"4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\shmt.exeFilesize
196KB
MD5f9e95ae291c9d014bf6d7c035038c665
SHA12d5ce01b255c567489c218bd5cc72aa3a966fcd9
SHA2563c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a
SHA512f44d95b5fa0295122ac894724a896db353c740169167031413bf76e469b26af02d7652e6a79aa0fb10097ca7fb4b4437277fcce08623453a3bbbe42999e72970
-
C:\Windows\SysWOW64\shmt.exeFilesize
196KB
MD5f9e95ae291c9d014bf6d7c035038c665
SHA12d5ce01b255c567489c218bd5cc72aa3a966fcd9
SHA2563c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a
SHA512f44d95b5fa0295122ac894724a896db353c740169167031413bf76e469b26af02d7652e6a79aa0fb10097ca7fb4b4437277fcce08623453a3bbbe42999e72970
-
C:\Windows\SysWOW64\shmt.exeFilesize
196KB
MD5f9e95ae291c9d014bf6d7c035038c665
SHA12d5ce01b255c567489c218bd5cc72aa3a966fcd9
SHA2563c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a
SHA512f44d95b5fa0295122ac894724a896db353c740169167031413bf76e469b26af02d7652e6a79aa0fb10097ca7fb4b4437277fcce08623453a3bbbe42999e72970
-
\Windows\SysWOW64\shmt.exeFilesize
196KB
MD5f9e95ae291c9d014bf6d7c035038c665
SHA12d5ce01b255c567489c218bd5cc72aa3a966fcd9
SHA2563c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a
SHA512f44d95b5fa0295122ac894724a896db353c740169167031413bf76e469b26af02d7652e6a79aa0fb10097ca7fb4b4437277fcce08623453a3bbbe42999e72970
-
\Windows\SysWOW64\shmt.exeFilesize
196KB
MD5f9e95ae291c9d014bf6d7c035038c665
SHA12d5ce01b255c567489c218bd5cc72aa3a966fcd9
SHA2563c4e2b752f1f9976b4638a60cc606d4db88e4326cebaa99ef41df6bbdbc31f1a
SHA512f44d95b5fa0295122ac894724a896db353c740169167031413bf76e469b26af02d7652e6a79aa0fb10097ca7fb4b4437277fcce08623453a3bbbe42999e72970
-
memory/1652-61-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1652-62-0x00000000765C1000-0x00000000765C3000-memory.dmpFilesize
8KB
-
memory/1652-58-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1652-57-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1652-59-0x00000000004084F0-mapping.dmp
-
memory/1652-77-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1732-79-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1732-80-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1732-73-0x00000000004084F0-mapping.dmp
-
memory/1944-54-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2032-65-0x0000000000000000-mapping.dmp