c266c7478056112542113a167ab78753e9e73dc0d273150e6dbb279d328a186d

General

Target

656df8c44d67ce51bcb17f6afb5de3f8.exe
Size

217KB
MD5

656df8c44d67ce51bcb17f6afb5de3f8
SHA1

0c09b7c71ec6177d187162d7a77a84631a4cdee0
SHA256

c266c7478056112542113a167ab78753e9e73dc0d273150e6dbb279d328a186d
SHA512

c3bd05337fd15553112d4a8cd1e985c72a1a4072f9387a07e841796b00f898d35dc4549c23fbd1096d1a22c2959b3497784cc5e7741107cbb76e96b5358c262d
SSDEEP

6144:vOJfFOCTyGmvaRu39kXIVw2xQkkqh5eYqGGLTsfOn:mJcCTyqLXxkkOHqBsOn

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
2560	656df8c44d67ce51bcb17f6afb5de3f8.exe
2296	rundll32.exe
2296	rundll32.exe
2296	rundll32.exe
2296	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\Metropolis = "rundll32.exe C:\\Windows\\system32\\sshnas21.dll,GetHandle"	656df8c44d67ce51bcb17f6afb5de3f8.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sshnas21.dll	656df8c44d67ce51bcb17f6afb5de3f8.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2560	656df8c44d67ce51bcb17f6afb5de3f8.exe
2560	656df8c44d67ce51bcb17f6afb5de3f8.exe
2296	rundll32.exe
2296	rundll32.exe
2296	rundll32.exe
2296	rundll32.exe
2296	rundll32.exe
2296	rundll32.exe
2296	rundll32.exe
2296	rundll32.exe
2296	rundll32.exe
2296	rundll32.exe
2296	rundll32.exe
2296	rundll32.exe
2296	rundll32.exe
2296	rundll32.exe
2296	rundll32.exe
2296	rundll32.exe
2296	rundll32.exe
2296	rundll32.exe
2296	rundll32.exe
2296	rundll32.exe
2296	rundll32.exe
2296	rundll32.exe
2296	rundll32.exe
2296	rundll32.exe
2296	rundll32.exe
2296	rundll32.exe
2296	rundll32.exe
2296	rundll32.exe
2296	rundll32.exe
2296	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2560	656df8c44d67ce51bcb17f6afb5de3f8.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 2296	2560	656df8c44d67ce51bcb17f6afb5de3f8.exe	28
PID 2560 wrote to memory of 2296	2560	656df8c44d67ce51bcb17f6afb5de3f8.exe	28
PID 2560 wrote to memory of 2296	2560	656df8c44d67ce51bcb17f6afb5de3f8.exe	28
PID 2560 wrote to memory of 2296	2560	656df8c44d67ce51bcb17f6afb5de3f8.exe	28
PID 2560 wrote to memory of 2296	2560	656df8c44d67ce51bcb17f6afb5de3f8.exe	28
PID 2560 wrote to memory of 2296	2560	656df8c44d67ce51bcb17f6afb5de3f8.exe	28
PID 2560 wrote to memory of 2296	2560	656df8c44d67ce51bcb17f6afb5de3f8.exe	28

C:\Users\Admin\AppData\Local\Temp\656df8c44d67ce51bcb17f6afb5de3f8.exe
"C:\Users\Admin\AppData\Local\Temp\656df8c44d67ce51bcb17f6afb5de3f8.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Windows\system32\sshnas21.dll,GetHandle
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2296-25-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download
memory/2296-17-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download
memory/2296-29-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download
memory/2296-15-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download
memory/2296-28-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download
memory/2296-18-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download
memory/2296-16-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download
memory/2296-26-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download
memory/2296-19-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download
memory/2296-27-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download
memory/2296-22-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download
memory/2296-21-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download
memory/2296-20-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download
memory/2296-23-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download
memory/2296-24-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download
memory/2560-7-0x0000000000880000-0x00000000008A8000-memory.dmp

Filesize
160KB

Download
memory/2560-0-0x0000000000230000-0x0000000000255000-memory.dmp

Filesize
148KB

Download
memory/2560-1-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2560-9-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2560-8-0x0000000010000000-0x0000000010055000-memory.dmp

Filesize
340KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads