9d5368372dbb10b4d8ce041ff82dcde986a64f3e30eefdd6707dd7d1a781f57c

General

Target

9d5368372dbb10b4d8ce041ff82dcde986a64f3e30eefdd6707dd7d1a781f57c.exe
Size

174KB
MD5

55bc615b4885d265c5fce8a280d844df
SHA1

27b8b209ee9e22e1c2637787f4e36cd103b90076
SHA256

9d5368372dbb10b4d8ce041ff82dcde986a64f3e30eefdd6707dd7d1a781f57c
SHA512

86dcf1beaed06e9af0eba73b47837e46dc560be70fc997d4523a71320abf117e46a9b7886d4464ff6a55ec617ebf71843f5a170b5ee25f9d3dac6d57250c12d5
SSDEEP

3072:CeG0ei5lbgGiyGRYb+T2aja2c1CUzcgDOf8Gb3+m/j2:xGebgSGR/fdc1NzUf8c+

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
332	csrss.exe

Deletes itself 1 IoCs

pid	Process
2040	cmd.exe

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 900 set thread context of 2040	900	9d5368372dbb10b4d8ce041ff82dcde986a64f3e30eefdd6707dd7d1a781f57c.exe	27

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
900	9d5368372dbb10b4d8ce041ff82dcde986a64f3e30eefdd6707dd7d1a781f57c.exe
900	9d5368372dbb10b4d8ce041ff82dcde986a64f3e30eefdd6707dd7d1a781f57c.exe
900	9d5368372dbb10b4d8ce041ff82dcde986a64f3e30eefdd6707dd7d1a781f57c.exe
900	9d5368372dbb10b4d8ce041ff82dcde986a64f3e30eefdd6707dd7d1a781f57c.exe
332	csrss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	900	9d5368372dbb10b4d8ce041ff82dcde986a64f3e30eefdd6707dd7d1a781f57c.exe
Token: SeDebugPrivilege	900	9d5368372dbb10b4d8ce041ff82dcde986a64f3e30eefdd6707dd7d1a781f57c.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1192	Explorer.EXE
1192	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1192	Explorer.EXE
1192	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
332	csrss.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1192	900	9d5368372dbb10b4d8ce041ff82dcde986a64f3e30eefdd6707dd7d1a781f57c.exe	20
PID 900 wrote to memory of 332	900	9d5368372dbb10b4d8ce041ff82dcde986a64f3e30eefdd6707dd7d1a781f57c.exe	6
PID 900 wrote to memory of 2040	900	9d5368372dbb10b4d8ce041ff82dcde986a64f3e30eefdd6707dd7d1a781f57c.exe	27
PID 900 wrote to memory of 2040	900	9d5368372dbb10b4d8ce041ff82dcde986a64f3e30eefdd6707dd7d1a781f57c.exe	27
PID 900 wrote to memory of 2040	900	9d5368372dbb10b4d8ce041ff82dcde986a64f3e30eefdd6707dd7d1a781f57c.exe	27
PID 900 wrote to memory of 2040	900	9d5368372dbb10b4d8ce041ff82dcde986a64f3e30eefdd6707dd7d1a781f57c.exe	27
PID 900 wrote to memory of 2040	900	9d5368372dbb10b4d8ce041ff82dcde986a64f3e30eefdd6707dd7d1a781f57c.exe	27
PID 332 wrote to memory of 872	332	csrss.exe	11

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:872

C:\Users\Admin\AppData\Local\Temp\9d5368372dbb10b4d8ce041ff82dcde986a64f3e30eefdd6707dd7d1a781f57c.exe
"C:\Users\Admin\AppData\Local\Temp\9d5368372dbb10b4d8ce041ff82dcde986a64f3e30eefdd6707dd7d1a781f57c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Deletes itself
  PID:2040

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32\consrv.dll

Filesize
52KB

MD5
6bf2039986af96d98e08824ac6c383fd

SHA1
0bb6384656a96943cb427baa92446f987219a02e

SHA256
a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

SHA512
fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

Download Submit
\??\globalroot\systemroot\assembly\temp\@

Filesize
2KB

MD5
ed34ce2cae141ece41fda406dc9e4a22

SHA1
114321217070cd71de3803bd74d776f3bda20cec

SHA256
111304d1cdff92ab9dbfb2e96e007c543acdb707c829ef473178521956212b7c

SHA512
b935d4bd19aa35f87f32270663d9091ec253aae043349121251a091fa46074505607b29b8f39445d311af79f8f24ffaf09c94892729d4f9c2e653873cff6a5ca

Download Submit
\Windows\System32\consrv.dll

Filesize
52KB

MD5
6bf2039986af96d98e08824ac6c383fd

SHA1
0bb6384656a96943cb427baa92446f987219a02e

SHA256
a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

SHA512
fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

Download Submit
memory/332-70-0x0000000000B00000-0x0000000000B11000-memory.dmp

Filesize
68KB

Download
memory/872-78-0x00000000008C0000-0x00000000008CB000-memory.dmp

Filesize
44KB

Download
memory/872-74-0x00000000008C0000-0x00000000008CB000-memory.dmp

Filesize
44KB

Download
memory/872-86-0x00000000008B0000-0x00000000008B8000-memory.dmp

Filesize
32KB

Download
memory/872-87-0x00000000008D0000-0x00000000008DB000-memory.dmp

Filesize
44KB

Download
memory/872-85-0x00000000008D0000-0x00000000008DB000-memory.dmp

Filesize
44KB

Download
memory/872-84-0x00000000008B0000-0x00000000008B8000-memory.dmp

Filesize
32KB

Download
memory/872-82-0x00000000008C0000-0x00000000008CB000-memory.dmp

Filesize
44KB

Download
memory/900-73-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/900-71-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/900-54-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download
memory/900-56-0x00000000002C0000-0x00000000002F4000-memory.dmp

Filesize
208KB

Download
memory/900-55-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/900-57-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/900-58-0x00000000002C0000-0x00000000002F4000-memory.dmp

Filesize
208KB

Download
memory/1192-59-0x0000000002A70000-0x0000000002A76000-memory.dmp

Filesize
24KB

Download
memory/1192-67-0x0000000002A70000-0x0000000002A76000-memory.dmp

Filesize
24KB

Download
memory/1192-63-0x0000000002A70000-0x0000000002A76000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing