0bfab51fd27af2d3af3933de2c51f033550587e978fcf9f6c46183d7d43b88c3

General

Target

0bfab51fd27af2d3af3933de2c51f033550587e978fcf9f6c46183d7d43b88c3.exe
Size

332KB
MD5

6f85eb9b43f0b91f11b29f92e3289815
SHA1

2ca6dbe1dc42b5aac4363d6361f7ef4c9f5e3bbd
SHA256

0bfab51fd27af2d3af3933de2c51f033550587e978fcf9f6c46183d7d43b88c3
SHA512

da43eba10614b459477e840c8d663b346d00f75fa0232a6fb41c831d2cf8c798392984eb968ab746b2251d9eb93f156edb03f7aae7a3e863dadb3b3a45b02a30
SSDEEP

6144:xaNJmnQo41QAOMwEIzUjQiZZvEYqWnKZ+pnVai:x234BEIYjQWvrq1snki

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\csrss.exe\""	0bfab51fd27af2d3af3933de2c51f033550587e978fcf9f6c46183d7d43b88c3.exe

Executes dropped EXE 1 IoCs

pid	Process
704	csrss.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
1076	netsh.exe

Loads dropped DLL 2 IoCs

pid	Process
1884	0bfab51fd27af2d3af3933de2c51f033550587e978fcf9f6c46183d7d43b88c3.exe
1884	0bfab51fd27af2d3af3933de2c51f033550587e978fcf9f6c46183d7d43b88c3.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	0bfab51fd27af2d3af3933de2c51f033550587e978fcf9f6c46183d7d43b88c3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSWUpdate = "\"C:\\Users\\Admin\\AppData\\Roaming\\csrss.exe\""	0bfab51fd27af2d3af3933de2c51f033550587e978fcf9f6c46183d7d43b88c3.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	0bfab51fd27af2d3af3933de2c51f033550587e978fcf9f6c46183d7d43b88c3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MSWUpdate = "\"C:\\Users\\Admin\\AppData\\Roaming\\csrss.exe\""	0bfab51fd27af2d3af3933de2c51f033550587e978fcf9f6c46183d7d43b88c3.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	0bfab51fd27af2d3af3933de2c51f033550587e978fcf9f6c46183d7d43b88c3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	0bfab51fd27af2d3af3933de2c51f033550587e978fcf9f6c46183d7d43b88c3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1884	0bfab51fd27af2d3af3933de2c51f033550587e978fcf9f6c46183d7d43b88c3.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 1076	1884	0bfab51fd27af2d3af3933de2c51f033550587e978fcf9f6c46183d7d43b88c3.exe	29
PID 1884 wrote to memory of 1076	1884	0bfab51fd27af2d3af3933de2c51f033550587e978fcf9f6c46183d7d43b88c3.exe	29
PID 1884 wrote to memory of 1076	1884	0bfab51fd27af2d3af3933de2c51f033550587e978fcf9f6c46183d7d43b88c3.exe	29
PID 1884 wrote to memory of 1076	1884	0bfab51fd27af2d3af3933de2c51f033550587e978fcf9f6c46183d7d43b88c3.exe	29
PID 1884 wrote to memory of 704	1884	0bfab51fd27af2d3af3933de2c51f033550587e978fcf9f6c46183d7d43b88c3.exe	31
PID 1884 wrote to memory of 704	1884	0bfab51fd27af2d3af3933de2c51f033550587e978fcf9f6c46183d7d43b88c3.exe	31
PID 1884 wrote to memory of 704	1884	0bfab51fd27af2d3af3933de2c51f033550587e978fcf9f6c46183d7d43b88c3.exe	31
PID 1884 wrote to memory of 704	1884	0bfab51fd27af2d3af3933de2c51f033550587e978fcf9f6c46183d7d43b88c3.exe	31

C:\Users\Admin\AppData\Local\Temp\0bfab51fd27af2d3af3933de2c51f033550587e978fcf9f6c46183d7d43b88c3.exe
"C:\Users\Admin\AppData\Local\Temp\0bfab51fd27af2d3af3933de2c51f033550587e978fcf9f6c46183d7d43b88c3.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\csrss.exe" CityScape Enable
  2⤵
  - Modifies Windows Firewall
  PID:1076
- C:\Users\Admin\AppData\Roaming\csrss.exe
  /d C:\Users\Admin\AppData\Local\Temp\0bfab51fd27af2d3af3933de2c51f033550587e978fcf9f6c46183d7d43b88c3.exe
  2⤵
  - Executes dropped EXE
  PID:704

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\csrss.exe

Filesize
332KB

MD5
fe72a057918552b08d015ae0f04850f3

SHA1
de7698941421a12567180197bf7f5d2ac73ea5d1

SHA256
16b72e970a4c92a19acefc245d1b7ea92634d92b565d22e9e08892e88b798f2b

SHA512
0a8427be87c7d104a6a206c2ea3cb99961b6cf44df32a735bb7ecdbee4cca4cf8eb2b65de07b9ffc2bbc49a8cdecb82f7ab97189035b73d51c270d4b8c112d45

Download Submit
C:\Users\Admin\AppData\Roaming\csrss.exe

Filesize
332KB

MD5
fe72a057918552b08d015ae0f04850f3

SHA1
de7698941421a12567180197bf7f5d2ac73ea5d1

SHA256
16b72e970a4c92a19acefc245d1b7ea92634d92b565d22e9e08892e88b798f2b

SHA512
0a8427be87c7d104a6a206c2ea3cb99961b6cf44df32a735bb7ecdbee4cca4cf8eb2b65de07b9ffc2bbc49a8cdecb82f7ab97189035b73d51c270d4b8c112d45

Download Submit
\Users\Admin\AppData\Roaming\csrss.exe

Filesize
332KB

MD5
fe72a057918552b08d015ae0f04850f3

SHA1
de7698941421a12567180197bf7f5d2ac73ea5d1

SHA256
16b72e970a4c92a19acefc245d1b7ea92634d92b565d22e9e08892e88b798f2b

SHA512
0a8427be87c7d104a6a206c2ea3cb99961b6cf44df32a735bb7ecdbee4cca4cf8eb2b65de07b9ffc2bbc49a8cdecb82f7ab97189035b73d51c270d4b8c112d45

Download Submit
\Users\Admin\AppData\Roaming\csrss.exe

Filesize
332KB

MD5
fe72a057918552b08d015ae0f04850f3

SHA1
de7698941421a12567180197bf7f5d2ac73ea5d1

SHA256
16b72e970a4c92a19acefc245d1b7ea92634d92b565d22e9e08892e88b798f2b

SHA512
0a8427be87c7d104a6a206c2ea3cb99961b6cf44df32a735bb7ecdbee4cca4cf8eb2b65de07b9ffc2bbc49a8cdecb82f7ab97189035b73d51c270d4b8c112d45

Download Submit
memory/1076-62-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download
memory/1884-54-0x0000000000460000-0x00000000004B5000-memory.dmp

Filesize
340KB

Download
memory/1884-55-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1884-61-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads