009dae0a4892cc0d44f4d230edb301d10cf37b76d724b546880f48c21a9d9563

General

Target

009dae0a4892cc0d44f4d230edb301d10cf37b76d724b546880f48c21a9d9563.exe
Size

3.8MB
MD5

59a8ad9df39a24463e6f88be2f5658aa
SHA1

6c7d2b44eb640be26358eb7bbe68e5189accc329
SHA256

009dae0a4892cc0d44f4d230edb301d10cf37b76d724b546880f48c21a9d9563
SHA512

305ea17ef8531bb71e09d67c3253de8a4d3f2c9802c26a4c1605e2c1164dfb2a7b3d55123840692957ba9c107fb36e890eb1ed01b6a9826ea1c543efbfae1b3b

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

C:\Users\Admin\AppData\Local\Temp\009dae0a4892cc0d44f4d230edb301d10cf37b76d724b546880f48c21a9d9563.exe
"C:\Users\Admin\AppData\Local\Temp\009dae0a4892cc0d44f4d230edb301d10cf37b76d724b546880f48c21a9d9563.exe"
1⤵
PID:2584

C:\Users\Admin\AppData\Local\Temp\009dae0a4892cc0d44f4d230edb301d10cf37b76d724b546880f48c21a9d9563.exe
"C:\Users\Admin\AppData\Local\Temp\009dae0a4892cc0d44f4d230edb301d10cf37b76d724b546880f48c21a9d9563.exe"
2⤵
PID:2432

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
3⤵
PID:5068

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe" enable=yes"
3⤵
PID:3196

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe ""
3⤵
PID:732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
1⤵
PID:4756

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
1⤵
PID:4964

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe" enable=yes
1⤵
PID:3556

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\rss\csrss.exe
Filesize
81KB

MD5
a55f43f2023fcc8372ecef79681df44a

SHA1
9ac854ab15f13d4e7002ef4fda6f03913e7030a9

SHA256
bcfecb3348593a1082579af1d77a71988dab1dbb72448bfb5a36a42ef9408648

SHA512
6e1214adb6cb275a4462c3160326cb580f018690ff02a14006a7a17efed759351a7cc479922f45f0da03443d0c3153cbc66d04a58e1eada12e927c7dc5e47fdc

Download Submit
C:\Windows\rss\csrss.exe
Filesize
61KB

MD5
68e866244af6ab5670ffe15fcbdf1b16

SHA1
b460cde1f8adc409b4eb0caac845352fd5fdb1c9

SHA256
564ca16e2b68d2f2221722c9c63949f6494a3dc0aa87837aa5b22dd3d2f9a707

SHA512
549bbc84d8effe2e97dce01d9d08333545a19d15844075e8766cf7e06cdf5ce0367687fa1057f7c561c7e77cf5ccbd5a42f418393120ab0e9c347cf73e85c86a

Download Submit
memory/732-144-0x0000000000400000-0x000000000521C000-memory.dmp

Filesize
78.1MB

Download
memory/732-143-0x0000000007400000-0x00000000077A4000-memory.dmp

Filesize
3.6MB

Download
memory/732-140-0x0000000000000000-mapping.dmp

Download
memory/2432-136-0x0000000006FE4000-0x0000000007388000-memory.dmp

Filesize
3.6MB

Download
memory/2432-139-0x0000000000400000-0x000000000521C000-memory.dmp

Filesize
78.1MB

Download
memory/2432-133-0x0000000000000000-mapping.dmp

Download
memory/2584-130-0x00000000071CB000-0x000000000756F000-memory.dmp

Filesize
3.6MB

Download
memory/2584-132-0x0000000000400000-0x000000000521C000-memory.dmp

Filesize
78.1MB

Download
memory/2584-131-0x0000000007570000-0x0000000007C5E000-memory.dmp

Filesize
6.9MB

Download
memory/3196-137-0x0000000000000000-mapping.dmp

Download
memory/3556-138-0x0000000000000000-mapping.dmp

Download
memory/4964-135-0x0000000000000000-mapping.dmp

Download
memory/5068-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads