glupteba | 590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7

General

Target

590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Size

4.1MB
MD5

1f788878ba94f192dbe2b03164d7091c
SHA1

d6138b8c42969871d22cbe2770396908f23961e0
SHA256

590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7
SHA512

2dc4ce062a51768bd5272605750cc04358eb53a69f10c247721ecb469bd7b2475d3e5be059210b512de45af18fcf74e3beff356e053a97eb1afb556090fa1300
SSDEEP

98304:LBYslVgY6kBPq4RNwR/5EIbtUSupLH82MKeaS40Kh:Ndo4Rap5EIbjuQkh

Score

10^/10

glupteba dropper evasion loader persistence

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

svchost.exe

description pid process target process

PID 1568 created 3716 1568 svchost.exe 590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Executes dropped EXE 1 IoCs

Processes:

csrss.exe

pid process

2200 csrss.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

3992 netsh.exe

description	pid	process	target process
PID 1568 created 3716	1568	svchost.exe	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe

pid	process
2200	csrss.exe

pid	process
3992	netsh.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe

Drops file in Windows directory 2 IoCs

Processes:

590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe

description	ioc	process
File opened for modification	C:\Windows\rss	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
File created	C:\Windows\rss\csrss.exe	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
2976	3716	WerFault.exe	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
3620	1016	WerFault.exe	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2941 = "Sao Tome Daylight Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time"	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe

pid	process
3716	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
3716	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
1016	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
1016	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
1016	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
1016	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
1016	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
1016	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
1016	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
1016	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
1016	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
1016	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	3716	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Token: SeImpersonatePrivilege	3716	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
Token: SeTcbPrivilege	1568	svchost.exe
Token: SeTcbPrivilege	1568	svchost.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

svchost.exe590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.execmd.exe

description	pid	process	target process
PID 1568 wrote to memory of 1016	1568	svchost.exe	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
PID 1568 wrote to memory of 1016	1568	svchost.exe	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
PID 1568 wrote to memory of 1016	1568	svchost.exe	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
PID 1016 wrote to memory of 4256	1016	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe	cmd.exe
PID 1016 wrote to memory of 4256	1016	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe	cmd.exe
PID 4256 wrote to memory of 3992	4256	cmd.exe	netsh.exe
PID 4256 wrote to memory of 3992	4256	cmd.exe	netsh.exe
PID 1016 wrote to memory of 2200	1016	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe	csrss.exe
PID 1016 wrote to memory of 2200	1016	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe	csrss.exe
PID 1016 wrote to memory of 2200	1016	590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe	csrss.exe

C:\Users\Admin\AppData\Local\Temp\590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
"C:\Users\Admin\AppData\Local\Temp\590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3716
- C:\Users\Admin\AppData\Local\Temp\590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe
  "C:\Users\Admin\AppData\Local\Temp\590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4256
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:3992
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    PID:2200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 860
    3⤵
    - Program crash
    PID:3620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 896
  2⤵
  - Program crash
  PID:2976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3716 -ip 3716
1⤵
PID:4548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1016 -ip 1016
1⤵
PID:4920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\rss\csrss.exe

Filesize
4.1MB

MD5
1f788878ba94f192dbe2b03164d7091c

SHA1
d6138b8c42969871d22cbe2770396908f23961e0

SHA256
590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7

SHA512
2dc4ce062a51768bd5272605750cc04358eb53a69f10c247721ecb469bd7b2475d3e5be059210b512de45af18fcf74e3beff356e053a97eb1afb556090fa1300

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.1MB

MD5
1f788878ba94f192dbe2b03164d7091c

SHA1
d6138b8c42969871d22cbe2770396908f23961e0

SHA256
590cac9fc69bf7d12bf7ab7de907b00b9a1da0ed23f68ff536b75796c10ca6c7

SHA512
2dc4ce062a51768bd5272605750cc04358eb53a69f10c247721ecb469bd7b2475d3e5be059210b512de45af18fcf74e3beff356e053a97eb1afb556090fa1300

Download Submit
memory/1016-139-0x0000000002A1C000-0x0000000002E05000-memory.dmp

Filesize
3.9MB

Download
memory/1016-144-0x0000000000400000-0x0000000000C91000-memory.dmp

Filesize
8.6MB

Download
memory/1016-135-0x0000000000000000-mapping.dmp

Download
memory/1016-140-0x0000000000400000-0x0000000000C91000-memory.dmp

Filesize
8.6MB

Download
memory/2200-141-0x0000000000000000-mapping.dmp

Download
memory/3716-132-0x0000000002C1F000-0x0000000003008000-memory.dmp

Filesize
3.9MB

Download
memory/3716-136-0x0000000000400000-0x0000000000C91000-memory.dmp

Filesize
8.6MB

Download
memory/3716-134-0x0000000000400000-0x0000000000C91000-memory.dmp

Filesize
8.6MB

Download
memory/3716-133-0x0000000003010000-0x0000000003886000-memory.dmp

Filesize
8.5MB

Download
memory/3992-138-0x0000000000000000-mapping.dmp

Download
memory/4256-137-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads