e150303e8c822ffad7b1f6dc1de7dda37fc9885935bc01125dce7d84e5c7455a

General

Target

e150303e8c822ffad7b1f6dc1de7dda37fc9885935bc01125dce7d84e5c7455a.exe
Size

171KB
MD5

4420b6a879b7640a697075178e0747d0
SHA1

7e821fd773b32101dd6e0acab39155061cc6f6d4
SHA256

e150303e8c822ffad7b1f6dc1de7dda37fc9885935bc01125dce7d84e5c7455a
SHA512

bd83917504517aec8067f26b49a23af600dbed6174b572eda5bb1e1413ebca349e3eff94154bb7775aebfffe152eda28d4a5a3362f27042ef862dacc1000e491
SSDEEP

3072:DQT7R5BszJrSGY9JLiQklkXxy08q48+39Kb1btJ3Snq:cT7R5Bk6QiEspbnG

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

csrss.exe

pid process

332 csrss.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2016 cmd.exe
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 94.242.250.64
Destination IP 94.242.250.64
Destination IP 94.242.250.64
Destination IP 94.242.250.64
Drops desktop.ini file(s) 2 IoCs

Processes:

csrss.exe

description ioc process

File created \systemroot\assembly\GAC_64\Desktop.ini csrss.exe
File created \systemroot\assembly\GAC_32\Desktop.ini csrss.exe

pid	process
332	csrss.exe

pid	process
2016	cmd.exe

description	ioc
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64

description	ioc	process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

e150303e8c822ffad7b1f6dc1de7dda37fc9885935bc01125dce7d84e5c7455a.exe

description	pid	process	target process
PID 1652 set thread context of 2016	1652	e150303e8c822ffad7b1f6dc1de7dda37fc9885935bc01125dce7d84e5c7455a.exe	cmd.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

e150303e8c822ffad7b1f6dc1de7dda37fc9885935bc01125dce7d84e5c7455a.execsrss.exe

pid	process
1652	e150303e8c822ffad7b1f6dc1de7dda37fc9885935bc01125dce7d84e5c7455a.exe
1652	e150303e8c822ffad7b1f6dc1de7dda37fc9885935bc01125dce7d84e5c7455a.exe
1652	e150303e8c822ffad7b1f6dc1de7dda37fc9885935bc01125dce7d84e5c7455a.exe
1652	e150303e8c822ffad7b1f6dc1de7dda37fc9885935bc01125dce7d84e5c7455a.exe
332	csrss.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

e150303e8c822ffad7b1f6dc1de7dda37fc9885935bc01125dce7d84e5c7455a.exe

pid process

1652 e150303e8c822ffad7b1f6dc1de7dda37fc9885935bc01125dce7d84e5c7455a.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

e150303e8c822ffad7b1f6dc1de7dda37fc9885935bc01125dce7d84e5c7455a.exe

description	pid	process
Token: SeDebugPrivilege	1652	e150303e8c822ffad7b1f6dc1de7dda37fc9885935bc01125dce7d84e5c7455a.exe
Token: SeDebugPrivilege	1652	e150303e8c822ffad7b1f6dc1de7dda37fc9885935bc01125dce7d84e5c7455a.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1276 Explorer.EXE
1276 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1276 Explorer.EXE
1276 Explorer.EXE
Suspicious use of UnmapMainImage 1 IoCs

Processes:

csrss.exe

pid process

332 csrss.exe

pid	process
1276	Explorer.EXE
1276	Explorer.EXE

pid	process
1276	Explorer.EXE
1276	Explorer.EXE

pid	process
332	csrss.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

e150303e8c822ffad7b1f6dc1de7dda37fc9885935bc01125dce7d84e5c7455a.execsrss.exe

description	pid	process	target process
PID 1652 wrote to memory of 1276	1652	e150303e8c822ffad7b1f6dc1de7dda37fc9885935bc01125dce7d84e5c7455a.exe	Explorer.EXE
PID 1652 wrote to memory of 332	1652	e150303e8c822ffad7b1f6dc1de7dda37fc9885935bc01125dce7d84e5c7455a.exe	csrss.exe
PID 1652 wrote to memory of 2016	1652	e150303e8c822ffad7b1f6dc1de7dda37fc9885935bc01125dce7d84e5c7455a.exe	cmd.exe
PID 1652 wrote to memory of 2016	1652	e150303e8c822ffad7b1f6dc1de7dda37fc9885935bc01125dce7d84e5c7455a.exe	cmd.exe
PID 1652 wrote to memory of 2016	1652	e150303e8c822ffad7b1f6dc1de7dda37fc9885935bc01125dce7d84e5c7455a.exe	cmd.exe
PID 1652 wrote to memory of 2016	1652	e150303e8c822ffad7b1f6dc1de7dda37fc9885935bc01125dce7d84e5c7455a.exe	cmd.exe
PID 1652 wrote to memory of 2016	1652	e150303e8c822ffad7b1f6dc1de7dda37fc9885935bc01125dce7d84e5c7455a.exe	cmd.exe
PID 332 wrote to memory of 860	332	csrss.exe	svchost.exe

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:332

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1276

C:\Users\Admin\AppData\Local\Temp\e150303e8c822ffad7b1f6dc1de7dda37fc9885935bc01125dce7d84e5c7455a.exe
"C:\Users\Admin\AppData\Local\Temp\e150303e8c822ffad7b1f6dc1de7dda37fc9885935bc01125dce7d84e5c7455a.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Deletes itself
PID:2016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32\consrv.dll
Filesize
52KB

MD5
6bf2039986af96d98e08824ac6c383fd

SHA1
0bb6384656a96943cb427baa92446f987219a02e

SHA256
a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

SHA512
fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

Download Submit
\??\globalroot\systemroot\assembly\temp\@
Filesize
2KB

MD5
4cf54cdd90d31a90555f5194a8c928bd

SHA1
5e90b74b0ab652284831b5614fe50fe73db88e19

SHA256
2bcc563afe248b5854d22270ae7deb69f1c42818e99133de4242fbe9a9f7ec75

SHA512
45791ab02b86d494d2bdb7f67d0e436f9a002a4dca55ad223e5367ff1e2ed63f7af81ac2ac347e8720ce9589d949f675c45cbc782a69fb885358ad6703cc18fe

Download Submit
\Windows\System32\consrv.dll
Filesize
52KB

MD5
6bf2039986af96d98e08824ac6c383fd

SHA1
0bb6384656a96943cb427baa92446f987219a02e

SHA256
a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

SHA512
fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

Download Submit
memory/332-68-0x0000000001EF0000-0x0000000001F01000-memory.dmp

Filesize
68KB

Download
memory/860-75-0x0000000000340000-0x000000000034B000-memory.dmp

Filesize
44KB

Download
memory/860-84-0x0000000000350000-0x000000000035B000-memory.dmp

Filesize
44KB

Download
memory/860-83-0x0000000000330000-0x0000000000338000-memory.dmp

Filesize
32KB

Download
memory/860-82-0x0000000000350000-0x000000000035B000-memory.dmp

Filesize
44KB

Download
memory/860-81-0x0000000000330000-0x0000000000338000-memory.dmp

Filesize
32KB

Download
memory/860-71-0x0000000000340000-0x000000000034B000-memory.dmp

Filesize
44KB

Download
memory/860-79-0x0000000000340000-0x000000000034B000-memory.dmp

Filesize
44KB

Download
memory/1276-60-0x0000000002A00000-0x0000000002A06000-memory.dmp

Filesize
24KB

Download
memory/1276-56-0x0000000002A00000-0x0000000002A06000-memory.dmp

Filesize
24KB

Download
memory/1276-64-0x0000000002A00000-0x0000000002A06000-memory.dmp

Filesize
24KB

Download
memory/1652-55-0x0000000000280000-0x00000000002C8000-memory.dmp

Filesize
288KB

Download
memory/1652-70-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1652-54-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1652-65-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2016-69-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads