18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612

General

Target

18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe
Size

184KB
MD5

9255d99c1c4eb4b7b4aabdb4aae1dec6
SHA1

8c55e6b16241b7022e8f9dce03482c0c87e9aaf0
SHA256

18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612
SHA512

8ba91ec692efa2050f376eeec65f38f68e649100001311873f6426908f9892dd1231f98273827f4c677317b12afd3c7f4bd07419ef1b0d2f713ec1011f49c07c
SSDEEP

3072:++V2Uz616rBNEbGdtV8P7xWmbsSw1UKqjlU3YZhIrcNCcN5Q4jkXqSbo4nvSMgHt:B2Uz7MEExf+IZ2qLGqSbokvSMgbD0Re

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
332	csrss.exe

Deletes itself 1 IoCs

pid	Process
1976	cmd.exe

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 532 set thread context of 1976	532	18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe	27

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
532	18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe
532	18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe
532	18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe
532	18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe
332	csrss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	532	18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe
Token: SeDebugPrivilege	532	18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
332	csrss.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 1412	532	18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe	14
PID 532 wrote to memory of 332	532	18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe	6
PID 532 wrote to memory of 1976	532	18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe	27
PID 532 wrote to memory of 1976	532	18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe	27
PID 532 wrote to memory of 1976	532	18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe	27
PID 532 wrote to memory of 1976	532	18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe	27
PID 532 wrote to memory of 1976	532	18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe	27
PID 332 wrote to memory of 868	332	csrss.exe	20

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:332

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1412
- C:\Users\Admin\AppData\Local\Temp\18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe
  "C:\Users\Admin\AppData\Local\Temp\18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:532
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:1976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32\consrv.dll

Filesize
52KB

MD5
6bf2039986af96d98e08824ac6c383fd

SHA1
0bb6384656a96943cb427baa92446f987219a02e

SHA256
a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

SHA512
fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

Download Submit
\??\globalroot\systemroot\assembly\temp\@

Filesize
2KB

MD5
c5e2dcd9bee4cc6d0f93548c464882b6

SHA1
03b1bd6756a372bd6903cdfac97d94ee48b91a15

SHA256
97977658dfc8aeb594c087d50bd92cfff22dc5511b790df6c48d7693e22d6420

SHA512
b4fa67daa77c7dd3d1083d2d9c0cea7a6dadf8eb7b0a508da1ac05104d9bf82dacb5e12e3e5e2cae233db22cafe9e1784f5a62aa4beb9c231f9c9fd2a2758233

Download Submit
\Windows\System32\consrv.dll

Filesize
52KB

MD5
6bf2039986af96d98e08824ac6c383fd

SHA1
0bb6384656a96943cb427baa92446f987219a02e

SHA256
a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

SHA512
fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

Download Submit
memory/332-69-0x0000000001EF0000-0x0000000001F01000-memory.dmp

Filesize
68KB

Download
memory/532-70-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/532-55-0x0000000000220000-0x000000000025F000-memory.dmp

Filesize
252KB

Download
memory/532-57-0x0000000000220000-0x000000000025F000-memory.dmp

Filesize
252KB

Download
memory/532-56-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/532-54-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/532-72-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/868-81-0x00000000008C0000-0x00000000008CB000-memory.dmp

Filesize
44KB

Download
memory/868-77-0x00000000008C0000-0x00000000008CB000-memory.dmp

Filesize
44KB

Download
memory/868-73-0x00000000008C0000-0x00000000008CB000-memory.dmp

Filesize
44KB

Download
memory/868-83-0x00000000008B0000-0x00000000008B8000-memory.dmp

Filesize
32KB

Download
memory/868-84-0x00000000008D0000-0x00000000008DB000-memory.dmp

Filesize
44KB

Download
memory/868-85-0x00000000008B0000-0x00000000008B8000-memory.dmp

Filesize
32KB

Download
memory/868-86-0x00000000008D0000-0x00000000008DB000-memory.dmp

Filesize
44KB

Download
memory/1412-66-0x0000000002780000-0x0000000002786000-memory.dmp

Filesize
24KB

Download
memory/1412-58-0x0000000002780000-0x0000000002786000-memory.dmp

Filesize
24KB

Download
memory/1412-62-0x0000000002780000-0x0000000002786000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing