73eebc72b6a280e6aae44d99efa7eca6ce621f420e50af7d49248c01ab68247f

General

Target

0126ea90433f3cffb1ce9ba4fa3e2e40.exe
Size

416KB
MD5

0126ea90433f3cffb1ce9ba4fa3e2e40
SHA1

6cf4af2ad62307c09aeff28a15082dabf2521081
SHA256

73eebc72b6a280e6aae44d99efa7eca6ce621f420e50af7d49248c01ab68247f
SHA512

67cddf07c11f684bcb91a0aa6002c0da034528b41145df81b907f4779f24f87bed1d73b5edda6064e7fc5c05f7a4ff4ef1e6281433f8402b79f478c61cfde679
SSDEEP

6144:bkqbvaFGC3aDn8dlHSKaEc/34svsJMiS0cdUeLpDebYSuyOB:bbvqVaDn8dl1c/uJMfLLsbduf

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
1680	0126ea90433f3cffb1ce9ba4fa3e2e40.exe
2748	rundll32.exe
2748	rundll32.exe
2748	rundll32.exe
2748	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Metropolis = "rundll32.exe C:\\Windows\\system32\\sshnas21.dll,GetHandle"	0126ea90433f3cffb1ce9ba4fa3e2e40.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sshnas21.dll	0126ea90433f3cffb1ce9ba4fa3e2e40.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
1680	0126ea90433f3cffb1ce9ba4fa3e2e40.exe
1680	0126ea90433f3cffb1ce9ba4fa3e2e40.exe
2748	rundll32.exe
2748	rundll32.exe
2748	rundll32.exe
2748	rundll32.exe
2748	rundll32.exe
2748	rundll32.exe
2748	rundll32.exe
2748	rundll32.exe
2748	rundll32.exe
2748	rundll32.exe
2748	rundll32.exe
2748	rundll32.exe
2748	rundll32.exe
2748	rundll32.exe
2748	rundll32.exe
2748	rundll32.exe
2748	rundll32.exe
2748	rundll32.exe
2748	rundll32.exe
2748	rundll32.exe
2748	rundll32.exe
2748	rundll32.exe
2748	rundll32.exe
2748	rundll32.exe
2748	rundll32.exe
2748	rundll32.exe
2748	rundll32.exe
2748	rundll32.exe
2748	rundll32.exe
2748	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1680	0126ea90433f3cffb1ce9ba4fa3e2e40.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2748	1680	0126ea90433f3cffb1ce9ba4fa3e2e40.exe	2
PID 1680 wrote to memory of 2748	1680	0126ea90433f3cffb1ce9ba4fa3e2e40.exe	2
PID 1680 wrote to memory of 2748	1680	0126ea90433f3cffb1ce9ba4fa3e2e40.exe	2
PID 1680 wrote to memory of 2748	1680	0126ea90433f3cffb1ce9ba4fa3e2e40.exe	2
PID 1680 wrote to memory of 2748	1680	0126ea90433f3cffb1ce9ba4fa3e2e40.exe	2
PID 1680 wrote to memory of 2748	1680	0126ea90433f3cffb1ce9ba4fa3e2e40.exe	2
PID 1680 wrote to memory of 2748	1680	0126ea90433f3cffb1ce9ba4fa3e2e40.exe	2

C:\Users\Admin\AppData\Local\Temp\0126ea90433f3cffb1ce9ba4fa3e2e40.exe
"C:\Users\Admin\AppData\Local\Temp\0126ea90433f3cffb1ce9ba4fa3e2e40.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Windows\system32\sshnas21.dll,GetHandle
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\sshnas21.dll

Filesize
348KB

MD5
9a5976205f57843a002498ce43c1a505

SHA1
ffccfc0a621e1ebc6b60dee80cc7f8ca2e89b421

SHA256
c7a39d43b2e18a19c8432141d9c06139716316806e5f93b2b90000c18497a271

SHA512
918916a0ec401f5946f7a7b6603cbbd60b92d8d315bb7233ff76c2122ef8fb33e44a6d3a934fd7ff7476a6751cf88482300fc776beebc63f42cf7bec0a3c2562

Download Submit
memory/1680-0-0x0000000000320000-0x0000000000336000-memory.dmp

Filesize
88KB

Download
memory/1680-9-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1680-8-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download
memory/1680-7-0x00000000003D0000-0x00000000003DB000-memory.dmp

Filesize
44KB

Download
memory/1680-1-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2748-19-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download
memory/2748-16-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download
memory/2748-17-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download
memory/2748-18-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download
memory/2748-15-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download
memory/2748-20-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download
memory/2748-21-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download
memory/2748-22-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download
memory/2748-23-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download
memory/2748-24-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download
memory/2748-25-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download
memory/2748-26-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download
memory/2748-27-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download
memory/2748-28-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download
memory/2748-29-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads