bd2958f76e95c9ed7165c2b69526921c9ab54706ec62782ccb5e41d27547e6d4

Analysis

max time kernel
167s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 11:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd2958f76e95c9ed7165c2b69526921c9ab54706ec62782ccb5e41d27547e6d4.exe
Size

226KB
MD5

b039115dff95c56c0479396a99a2004b
SHA1

3e7f02e6b3ad4b5ea28f409d9c8836526090deb2
SHA256

bd2958f76e95c9ed7165c2b69526921c9ab54706ec62782ccb5e41d27547e6d4
SHA512

1682da63871724f528dd81d665c965d49fdac7e17f7530f92d8b9c175188d22c1f09d58886c4aa93f447959881925f357d0d9a3139d16f2b4f07bb7f3b41fe91
SSDEEP

3072:Sq9Pe55UpJcp2mz2dDqvoB5yR8zh5UbhL1TuQf3O0zTZd0dZa2pppWGssBTAu:zPev6roODqvQ5SymhL1TuQpzddgppTt

Score

8^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
13	540	rundll32.exe

Loads dropped DLL 2 IoCs

pid	Process
1672	bd2958f76e95c9ed7165c2b69526921c9ab54706ec62782ccb5e41d27547e6d4.exe
540	rundll32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	bd2958f76e95c9ed7165c2b69526921c9ab54706ec62782ccb5e41d27547e6d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Canaveral = "rundll32.exe C:\\Windows\\system32\\sshnas21.dll,BackupReadW"	bd2958f76e95c9ed7165c2b69526921c9ab54706ec62782ccb5e41d27547e6d4.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sshnas21.dll	bd2958f76e95c9ed7165c2b69526921c9ab54706ec62782ccb5e41d27547e6d4.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4824	1672	WerFault.exe	71

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
1672	bd2958f76e95c9ed7165c2b69526921c9ab54706ec62782ccb5e41d27547e6d4.exe
1672	bd2958f76e95c9ed7165c2b69526921c9ab54706ec62782ccb5e41d27547e6d4.exe
1672	bd2958f76e95c9ed7165c2b69526921c9ab54706ec62782ccb5e41d27547e6d4.exe
1672	bd2958f76e95c9ed7165c2b69526921c9ab54706ec62782ccb5e41d27547e6d4.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe
540	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1672	bd2958f76e95c9ed7165c2b69526921c9ab54706ec62782ccb5e41d27547e6d4.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 540	1672	bd2958f76e95c9ed7165c2b69526921c9ab54706ec62782ccb5e41d27547e6d4.exe	80
PID 1672 wrote to memory of 540	1672	bd2958f76e95c9ed7165c2b69526921c9ab54706ec62782ccb5e41d27547e6d4.exe	80
PID 1672 wrote to memory of 540	1672	bd2958f76e95c9ed7165c2b69526921c9ab54706ec62782ccb5e41d27547e6d4.exe	80

C:\Users\Admin\AppData\Local\Temp\bd2958f76e95c9ed7165c2b69526921c9ab54706ec62782ccb5e41d27547e6d4.exe
"C:\Users\Admin\AppData\Local\Temp\bd2958f76e95c9ed7165c2b69526921c9ab54706ec62782ccb5e41d27547e6d4.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Windows\system32\sshnas21.dll,BackupReadW
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 576
  2⤵
  - Program crash
  PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1672 -ip 1672
1⤵
PID:4812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\sshnas21.dll

Filesize
188KB

MD5
5e07d6abea28aed975424ea81caa3211

SHA1
2a2e1835c65563b823d6c07a4646885e6155711e

SHA256
c66076d693a0fe9365da72d9ac967730adbf53f991c2a6a31a71f99d74243dac

SHA512
434736d75d1e900d03f8e3acecf1542f4978404191b0a197090296c3ded25a08656f498206dcc358f933c90026863806c6d7512f5834f4b8c096f4ff90b4a178

Download Submit
C:\Windows\SysWOW64\sshnas21.dll

Filesize
188KB

MD5
5e07d6abea28aed975424ea81caa3211

SHA1
2a2e1835c65563b823d6c07a4646885e6155711e

SHA256
c66076d693a0fe9365da72d9ac967730adbf53f991c2a6a31a71f99d74243dac

SHA512
434736d75d1e900d03f8e3acecf1542f4978404191b0a197090296c3ded25a08656f498206dcc358f933c90026863806c6d7512f5834f4b8c096f4ff90b4a178

Download Submit
C:\Windows\SysWOW64\sshnas21.dll

Filesize
188KB

MD5
5e07d6abea28aed975424ea81caa3211

SHA1
2a2e1835c65563b823d6c07a4646885e6155711e

SHA256
c66076d693a0fe9365da72d9ac967730adbf53f991c2a6a31a71f99d74243dac

SHA512
434736d75d1e900d03f8e3acecf1542f4978404191b0a197090296c3ded25a08656f498206dcc358f933c90026863806c6d7512f5834f4b8c096f4ff90b4a178

Download Submit
memory/540-139-0x0000000010000000-0x0000000010059000-memory.dmp

Filesize
356KB

Download
memory/540-140-0x0000000010000000-0x0000000010059000-memory.dmp

Filesize
356KB

Download
memory/540-141-0x0000000010000000-0x0000000010059000-memory.dmp

Filesize
356KB

Download
memory/1672-134-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1672-136-0x0000000010000000-0x0000000010059000-memory.dmp

Filesize
356KB

Download
memory/1672-135-0x0000000010000000-0x0000000010059000-memory.dmp

Filesize
356KB

Download