Analysis

  • max time kernel
    129s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    19/09/2022, 00:23

General

  • Target

    18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe

  • Size

    184KB

  • MD5

    9255d99c1c4eb4b7b4aabdb4aae1dec6

  • SHA1

    8c55e6b16241b7022e8f9dce03482c0c87e9aaf0

  • SHA256

    18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612

  • SHA512

    8ba91ec692efa2050f376eeec65f38f68e649100001311873f6426908f9892dd1231f98273827f4c677317b12afd3c7f4bd07419ef1b0d2f713ec1011f49c07c

  • SSDEEP

    3072:++V2Uz616rBNEbGdtV8P7xWmbsSw1UKqjlU3YZhIrcNCcN5Q4jkXqSbo4nvSMgHt:B2Uz7MEExf+IZ2qLGqSbokvSMgbD0Re

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Deletes itself 1 IoCs
  • Unexpected DNS network traffic destination 4 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\csrss.exe
    %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
    1⤵
    • Executes dropped EXE
    • Drops desktop.ini file(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:332
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1412
      • C:\Users\Admin\AppData\Local\Temp\18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe
        "C:\Users\Admin\AppData\Local\Temp\18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:532
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe"
          3⤵
          • Deletes itself
          PID:1976
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs
      1⤵
        PID:868

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\system32\consrv.dll

        Filesize

        52KB

        MD5

        6bf2039986af96d98e08824ac6c383fd

        SHA1

        0bb6384656a96943cb427baa92446f987219a02e

        SHA256

        a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

        SHA512

        fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

      • \??\globalroot\systemroot\assembly\temp\@

        Filesize

        2KB

        MD5

        c5e2dcd9bee4cc6d0f93548c464882b6

        SHA1

        03b1bd6756a372bd6903cdfac97d94ee48b91a15

        SHA256

        97977658dfc8aeb594c087d50bd92cfff22dc5511b790df6c48d7693e22d6420

        SHA512

        b4fa67daa77c7dd3d1083d2d9c0cea7a6dadf8eb7b0a508da1ac05104d9bf82dacb5e12e3e5e2cae233db22cafe9e1784f5a62aa4beb9c231f9c9fd2a2758233

      • \Windows\System32\consrv.dll

        Filesize

        52KB

        MD5

        6bf2039986af96d98e08824ac6c383fd

        SHA1

        0bb6384656a96943cb427baa92446f987219a02e

        SHA256

        a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

        SHA512

        fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

      • memory/332-69-0x0000000001EF0000-0x0000000001F01000-memory.dmp

        Filesize

        68KB

      • memory/532-70-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/532-55-0x0000000000220000-0x000000000025F000-memory.dmp

        Filesize

        252KB

      • memory/532-57-0x0000000000220000-0x000000000025F000-memory.dmp

        Filesize

        252KB

      • memory/532-56-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/532-54-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/532-72-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/868-81-0x00000000008C0000-0x00000000008CB000-memory.dmp

        Filesize

        44KB

      • memory/868-77-0x00000000008C0000-0x00000000008CB000-memory.dmp

        Filesize

        44KB

      • memory/868-73-0x00000000008C0000-0x00000000008CB000-memory.dmp

        Filesize

        44KB

      • memory/868-83-0x00000000008B0000-0x00000000008B8000-memory.dmp

        Filesize

        32KB

      • memory/868-84-0x00000000008D0000-0x00000000008DB000-memory.dmp

        Filesize

        44KB

      • memory/868-85-0x00000000008B0000-0x00000000008B8000-memory.dmp

        Filesize

        32KB

      • memory/868-86-0x00000000008D0000-0x00000000008DB000-memory.dmp

        Filesize

        44KB

      • memory/1412-66-0x0000000002780000-0x0000000002786000-memory.dmp

        Filesize

        24KB

      • memory/1412-58-0x0000000002780000-0x0000000002786000-memory.dmp

        Filesize

        24KB

      • memory/1412-62-0x0000000002780000-0x0000000002786000-memory.dmp

        Filesize

        24KB