Analysis
-
max time kernel
155s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
25-06-2022 09:44
Static task
static1
Behavioral task
behavioral1
Sample
398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe
Resource
win10v2004-20220414-en
General
-
Target
398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe
-
Size
4.3MB
-
MD5
23e940efe55576aeea02f54992c58d09
-
SHA1
7620ba8933e3cf83e757ae042f2adfb980174c8e
-
SHA256
398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5
-
SHA512
4b8c70dfc87a7d0f429ef6bd21ec669d30cedd02e701b19e094afb4c6d913a2d2a71ba6adc41e702cec219814d00a981ae5e33447be055878a2ff4c99a769ae3
Malware Config
Extracted
metasploit
windows/single_exec
Signatures
-
Glupteba Payload 7 IoCs
Processes:
resource yara_rule behavioral2/memory/2688-131-0x00000000052E0000-0x0000000005BEA000-memory.dmp family_glupteba behavioral2/memory/2688-132-0x0000000000400000-0x0000000002FB4000-memory.dmp family_glupteba behavioral2/memory/2688-134-0x0000000000400000-0x0000000002FB4000-memory.dmp family_glupteba behavioral2/memory/2280-136-0x0000000000400000-0x0000000002FB4000-memory.dmp family_glupteba behavioral2/memory/2280-143-0x0000000000400000-0x0000000002FB4000-memory.dmp family_glupteba behavioral2/memory/3328-145-0x0000000000400000-0x0000000002FB4000-memory.dmp family_glupteba behavioral2/memory/3328-147-0x0000000000400000-0x0000000002FB4000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
Processes:
svchost.exedescription pid process target process PID 3908 created 2688 3908 svchost.exe 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe PID 3908 created 3328 3908 svchost.exe csrss.exe -
Executes dropped EXE 2 IoCs
Processes:
csrss.exeinjector.exepid process 3328 csrss.exe 1740 injector.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IcyViolet = "\"C:\\Windows\\rss\\csrss.exe\"" 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 8 IoCs
Processes:
398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe -
Drops file in Windows directory 2 IoCs
Processes:
398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exedescription ioc process File opened for modification C:\Windows\rss 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe File created C:\Windows\rss\csrss.exe 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3120 2688 WerFault.exe 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
Processes:
description flow ioc HTTP User-Agent header 12 Go-http-client/1.1 -
Modifies data under HKEY_USERS 64 IoCs
Processes:
csrss.exe398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2941 = "Sao Tome Daylight Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time" csrss.exe -
Processes:
398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.execsrss.exeinjector.exepid process 2688 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe 2688 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe 2280 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe 2280 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe 3328 csrss.exe 3328 csrss.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe 1740 injector.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exesvchost.exe398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.execsrss.exedescription pid process Token: SeDebugPrivilege 2688 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe Token: SeImpersonatePrivilege 2688 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe Token: SeTcbPrivilege 3908 svchost.exe Token: SeTcbPrivilege 3908 svchost.exe Token: SeSystemEnvironmentPrivilege 2280 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe Token: SeBackupPrivilege 3908 svchost.exe Token: SeRestorePrivilege 3908 svchost.exe Token: SeBackupPrivilege 3908 svchost.exe Token: SeRestorePrivilege 3908 svchost.exe Token: SeSystemEnvironmentPrivilege 3328 csrss.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
svchost.exe398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.execmd.execsrss.exedescription pid process target process PID 3908 wrote to memory of 2280 3908 svchost.exe 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe PID 3908 wrote to memory of 2280 3908 svchost.exe 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe PID 3908 wrote to memory of 2280 3908 svchost.exe 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe PID 2280 wrote to memory of 2292 2280 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe cmd.exe PID 2280 wrote to memory of 2292 2280 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe cmd.exe PID 2292 wrote to memory of 2300 2292 cmd.exe netsh.exe PID 2292 wrote to memory of 2300 2292 cmd.exe netsh.exe PID 2280 wrote to memory of 3328 2280 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe csrss.exe PID 2280 wrote to memory of 3328 2280 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe csrss.exe PID 2280 wrote to memory of 3328 2280 398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe csrss.exe PID 3908 wrote to memory of 3808 3908 svchost.exe schtasks.exe PID 3908 wrote to memory of 3808 3908 svchost.exe schtasks.exe PID 3328 wrote to memory of 1740 3328 csrss.exe injector.exe PID 3328 wrote to memory of 1740 3328 csrss.exe injector.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe"C:\Users\Admin\AppData\Local\Temp\398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe"C:\Users\Admin\AppData\Local\Temp\398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe ""3⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 9402⤵
- Program crash
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2688 -ip 26881⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\rss\csrss.exeFilesize
4.3MB
MD523e940efe55576aeea02f54992c58d09
SHA17620ba8933e3cf83e757ae042f2adfb980174c8e
SHA256398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5
SHA5124b8c70dfc87a7d0f429ef6bd21ec669d30cedd02e701b19e094afb4c6d913a2d2a71ba6adc41e702cec219814d00a981ae5e33447be055878a2ff4c99a769ae3
-
C:\Windows\rss\csrss.exeFilesize
4.3MB
MD523e940efe55576aeea02f54992c58d09
SHA17620ba8933e3cf83e757ae042f2adfb980174c8e
SHA256398f65b46922e4a5a21ae7372fdf320ec5183f6f72da5f754db173807693fba5
SHA5124b8c70dfc87a7d0f429ef6bd21ec669d30cedd02e701b19e094afb4c6d913a2d2a71ba6adc41e702cec219814d00a981ae5e33447be055878a2ff4c99a769ae3
-
memory/1740-148-0x0000000000000000-mapping.dmp
-
memory/2280-135-0x0000000004BFC000-0x000000000502D000-memory.dmpFilesize
4.2MB
-
memory/2280-133-0x0000000000000000-mapping.dmp
-
memory/2280-136-0x0000000000400000-0x0000000002FB4000-memory.dmpFilesize
43.7MB
-
memory/2280-142-0x0000000004BFC000-0x000000000502D000-memory.dmpFilesize
4.2MB
-
memory/2280-143-0x0000000000400000-0x0000000002FB4000-memory.dmpFilesize
43.7MB
-
memory/2292-137-0x0000000000000000-mapping.dmp
-
memory/2300-138-0x0000000000000000-mapping.dmp
-
memory/2688-130-0x0000000004EA0000-0x00000000052D1000-memory.dmpFilesize
4.2MB
-
memory/2688-134-0x0000000000400000-0x0000000002FB4000-memory.dmpFilesize
43.7MB
-
memory/2688-131-0x00000000052E0000-0x0000000005BEA000-memory.dmpFilesize
9.0MB
-
memory/2688-132-0x0000000000400000-0x0000000002FB4000-memory.dmpFilesize
43.7MB
-
memory/3328-139-0x0000000000000000-mapping.dmp
-
memory/3328-147-0x0000000000400000-0x0000000002FB4000-memory.dmpFilesize
43.7MB
-
memory/3328-145-0x0000000000400000-0x0000000002FB4000-memory.dmpFilesize
43.7MB
-
memory/3328-144-0x0000000005200000-0x0000000005631000-memory.dmpFilesize
4.2MB
-
memory/3808-146-0x0000000000000000-mapping.dmp