bb0c41d8fef1d4943ae032d781e9b3987d24ebfc40fbb1266155d3d5d69f6749

General

Target

b6752c9be383d2650a0885d83442ee0b.exe
Size

294KB
MD5

b6752c9be383d2650a0885d83442ee0b
SHA1

2ff8ad85176df968d740eb3b4f681e0a158bf45e
SHA256

bb0c41d8fef1d4943ae032d781e9b3987d24ebfc40fbb1266155d3d5d69f6749
SHA512

bd7357b5e51e1f9f3cab8db93d476e4e4e2d9787a4ba2002363c27650cb4741f6d272eef9fc223abfe52533bd3a43bb52b6952e672f92d89c389078f194c48d2
SSDEEP

6144:6u+9V8DGub7wq9Gs9SOBAQ54Gya7SXz51JDjErSQq:6j63L9P4vQ54GyaSzfZE+Qq

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
1500	b6752c9be383d2650a0885d83442ee0b.exe
2248	rundll32.exe
2248	rundll32.exe
2248	rundll32.exe
2248	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Metropolis = "rundll32.exe C:\\Windows\\system32\\sshnas21.dll,GetHandle"	b6752c9be383d2650a0885d83442ee0b.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sshnas21.dll	b6752c9be383d2650a0885d83442ee0b.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
1500	b6752c9be383d2650a0885d83442ee0b.exe
1500	b6752c9be383d2650a0885d83442ee0b.exe
2248	rundll32.exe
2248	rundll32.exe
2248	rundll32.exe
2248	rundll32.exe
2248	rundll32.exe
2248	rundll32.exe
2248	rundll32.exe
2248	rundll32.exe
2248	rundll32.exe
2248	rundll32.exe
2248	rundll32.exe
2248	rundll32.exe
2248	rundll32.exe
2248	rundll32.exe
2248	rundll32.exe
2248	rundll32.exe
2248	rundll32.exe
2248	rundll32.exe
2248	rundll32.exe
2248	rundll32.exe
2248	rundll32.exe
2248	rundll32.exe
2248	rundll32.exe
2248	rundll32.exe
2248	rundll32.exe
2248	rundll32.exe
2248	rundll32.exe
2248	rundll32.exe
2248	rundll32.exe
2248	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1500	b6752c9be383d2650a0885d83442ee0b.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 2248	1500	b6752c9be383d2650a0885d83442ee0b.exe	28
PID 1500 wrote to memory of 2248	1500	b6752c9be383d2650a0885d83442ee0b.exe	28
PID 1500 wrote to memory of 2248	1500	b6752c9be383d2650a0885d83442ee0b.exe	28
PID 1500 wrote to memory of 2248	1500	b6752c9be383d2650a0885d83442ee0b.exe	28
PID 1500 wrote to memory of 2248	1500	b6752c9be383d2650a0885d83442ee0b.exe	28
PID 1500 wrote to memory of 2248	1500	b6752c9be383d2650a0885d83442ee0b.exe	28
PID 1500 wrote to memory of 2248	1500	b6752c9be383d2650a0885d83442ee0b.exe	28

C:\Users\Admin\AppData\Local\Temp\b6752c9be383d2650a0885d83442ee0b.exe
"C:\Users\Admin\AppData\Local\Temp\b6752c9be383d2650a0885d83442ee0b.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Windows\system32\sshnas21.dll,GetHandle
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\sshnas21.dll

Filesize
232KB

MD5
beb1b6d1a6d994b37a4e1d422bc8b465

SHA1
e521807a5073c7450b1c4604e8e92b9482dd1f43

SHA256
51a4db7fb8c7206b89278fa697902415d1fe2608588e652b9b910c41af491d20

SHA512
7fd274cdaafa5a1290514084e3f4af138e4759b5c06a5bc7a8a9f52d2e12211234be2f5bdb063791068a08f45e424cc361e30b7ff4825f8b8fb07b44035738ff

Download Submit
memory/1500-0-0x0000000000180000-0x0000000000189000-memory.dmp

Filesize
36KB

Download
memory/1500-4-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1500-7-0x0000000000310000-0x0000000000323000-memory.dmp

Filesize
76KB

Download
memory/1500-8-0x0000000010000000-0x0000000010060000-memory.dmp

Filesize
384KB

Download
memory/1500-9-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2248-19-0x0000000010000000-0x0000000010060000-memory.dmp

Filesize
384KB

Download
memory/2248-22-0x0000000010000000-0x0000000010060000-memory.dmp

Filesize
384KB

Download
memory/2248-17-0x0000000010000000-0x0000000010060000-memory.dmp

Filesize
384KB

Download
memory/2248-18-0x0000000010000000-0x0000000010060000-memory.dmp

Filesize
384KB

Download
memory/2248-15-0x0000000010000000-0x0000000010060000-memory.dmp

Filesize
384KB

Download
memory/2248-20-0x0000000010000000-0x0000000010060000-memory.dmp

Filesize
384KB

Download
memory/2248-21-0x0000000010000000-0x0000000010060000-memory.dmp

Filesize
384KB

Download
memory/2248-16-0x0000000010000000-0x0000000010060000-memory.dmp

Filesize
384KB

Download
memory/2248-23-0x0000000010000000-0x0000000010060000-memory.dmp

Filesize
384KB

Download
memory/2248-24-0x0000000010000000-0x0000000010060000-memory.dmp

Filesize
384KB

Download
memory/2248-25-0x0000000010000000-0x0000000010060000-memory.dmp

Filesize
384KB

Download
memory/2248-26-0x0000000010000000-0x0000000010060000-memory.dmp

Filesize
384KB

Download
memory/2248-27-0x0000000010000000-0x0000000010060000-memory.dmp

Filesize
384KB

Download
memory/2248-28-0x0000000010000000-0x0000000010060000-memory.dmp

Filesize
384KB

Download
memory/2248-29-0x0000000010000000-0x0000000010060000-memory.dmp

Filesize
384KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads