91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac

General

Target

91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe
Size

214KB
MD5

b9127a2bf6596a1be7c9820af4641ad9
SHA1

a3e39863616b50bc08aaae63f39774de0e9eb271
SHA256

91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac
SHA512

c52c658a2c5e7be8ab88ec18735381f6666a3e3ddeaa8f1ea3096c2b8975eed7dcd533afd3541a9d38afacf619a24d14f01f32d3a88c232ec8e8fa94e64006c9
SSDEEP

3072:s1IrCGCyzfGfHYYmvfB3tlLZkc+ORFRin/wYJT4hkONiVWVPk7eMgzSH+HqwN:s1WCGCyyOh9d2KRu/bJTNzYVPkMmHYp

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
332	csrss.exe

Deletes itself 1 IoCs

pid	Process
892	cmd.exe

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1788 set thread context of 892	1788	91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe	28

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1788	91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe
1788	91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe
1788	91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe
1788	91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe
332	csrss.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1208	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1788	91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe
Token: SeDebugPrivilege	1788	91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe
Token: SeShutdownPrivilege	1208	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1208	Explorer.EXE
1208	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1208	Explorer.EXE
1208	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
332	csrss.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 1208	1788	91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe	13
PID 1788 wrote to memory of 332	1788	91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe	26
PID 1788 wrote to memory of 892	1788	91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe	28
PID 1788 wrote to memory of 892	1788	91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe	28
PID 1788 wrote to memory of 892	1788	91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe	28
PID 1788 wrote to memory of 892	1788	91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe	28
PID 1788 wrote to memory of 892	1788	91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe	28
PID 332 wrote to memory of 864	332	csrss.exe	20

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1208
- C:\Users\Admin\AppData\Local\Temp\91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe
  "C:\Users\Admin\AppData\Local\Temp\91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:864

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32\consrv.dll

Filesize
52KB

MD5
6bf2039986af96d98e08824ac6c383fd

SHA1
0bb6384656a96943cb427baa92446f987219a02e

SHA256
a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

SHA512
fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

Download Submit
\??\globalroot\systemroot\assembly\temp\@

Filesize
2KB

MD5
033ff7fd0dd1b0d651e59067e8cf6d0b

SHA1
333477caf56e26c2200a677f785eebc625c58572

SHA256
580cc839f33b94814d757d0e6a164460e479e74800ef697ef626c7d649984b4c

SHA512
b769bb42019ce4dcbee6f12ac29948f266affe66cc2798a62285dadbe27b3af8cd0c32f25c638647df6814a7b16806d2b264e2c3f666a82cba3cace2a8dfcb5e

Download Submit
\Windows\System32\consrv.dll

Filesize
52KB

MD5
6bf2039986af96d98e08824ac6c383fd

SHA1
0bb6384656a96943cb427baa92446f987219a02e

SHA256
a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

SHA512
fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

Download Submit
memory/332-69-0x0000000001F80000-0x0000000001F91000-memory.dmp

Filesize
68KB

Download
memory/864-72-0x00000000003B0000-0x00000000003BB000-memory.dmp

Filesize
44KB

Download
memory/864-85-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/864-84-0x00000000003A0000-0x00000000003A8000-memory.dmp

Filesize
32KB

Download
memory/864-83-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/864-82-0x00000000003A0000-0x00000000003A8000-memory.dmp

Filesize
32KB

Download
memory/864-80-0x00000000003B0000-0x00000000003BB000-memory.dmp

Filesize
44KB

Download
memory/864-76-0x00000000003B0000-0x00000000003BB000-memory.dmp

Filesize
44KB

Download
memory/1208-66-0x0000000002A70000-0x0000000002A76000-memory.dmp

Filesize
24KB

Download
memory/1208-62-0x0000000002A70000-0x0000000002A76000-memory.dmp

Filesize
24KB

Download
memory/1208-56-0x0000000002A70000-0x0000000002A76000-memory.dmp

Filesize
24KB

Download
memory/1788-71-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1788-54-0x00000000760D1000-0x00000000760D3000-memory.dmp

Filesize
8KB

Download
memory/1788-59-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1788-57-0x0000000000270000-0x00000000002AE000-memory.dmp

Filesize
248KB

Download
memory/1788-55-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing