ca52d71157eb727bd83428292aae4be86ea5f0d30ef4965baae220437659666a

General

Target

ca52d71157eb727bd83428292aae4be86ea5f0d30ef4965baae220437659666a.exe
Size

191KB
MD5

cedeee26c160d6690c934cff2323f04f
SHA1

b504130e30e10e9473cc6d46294a4626e641b05d
SHA256

ca52d71157eb727bd83428292aae4be86ea5f0d30ef4965baae220437659666a
SHA512

8d1a4fa8316c94e243443d1db7689e12fc17c219c99252e5062872fb72d99f3f59102aa60b838dd5861bebc9aff069e37b040595ef2d3c616af01e50508cdaa5
SSDEEP

3072:BNX7OAVn2wczSwmg08SwsCWnKQ2E2On8wXdVxjH:BNqA8pzRmg08SwsCdQkbwX

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
332	csrss.exe

Deletes itself 1 IoCs

pid	Process
1752	cmd.exe

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2040 set thread context of 1752	2040	ca52d71157eb727bd83428292aae4be86ea5f0d30ef4965baae220437659666a.exe	27

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2040	ca52d71157eb727bd83428292aae4be86ea5f0d30ef4965baae220437659666a.exe
2040	ca52d71157eb727bd83428292aae4be86ea5f0d30ef4965baae220437659666a.exe
2040	ca52d71157eb727bd83428292aae4be86ea5f0d30ef4965baae220437659666a.exe
2040	ca52d71157eb727bd83428292aae4be86ea5f0d30ef4965baae220437659666a.exe
332	csrss.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1212	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2040	ca52d71157eb727bd83428292aae4be86ea5f0d30ef4965baae220437659666a.exe
Token: SeDebugPrivilege	2040	ca52d71157eb727bd83428292aae4be86ea5f0d30ef4965baae220437659666a.exe
Token: SeShutdownPrivilege	1212	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1212	Explorer.EXE
1212	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1212	Explorer.EXE
1212	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
332	csrss.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1212	2040	ca52d71157eb727bd83428292aae4be86ea5f0d30ef4965baae220437659666a.exe	15
PID 2040 wrote to memory of 332	2040	ca52d71157eb727bd83428292aae4be86ea5f0d30ef4965baae220437659666a.exe	6
PID 2040 wrote to memory of 1752	2040	ca52d71157eb727bd83428292aae4be86ea5f0d30ef4965baae220437659666a.exe	27
PID 2040 wrote to memory of 1752	2040	ca52d71157eb727bd83428292aae4be86ea5f0d30ef4965baae220437659666a.exe	27
PID 2040 wrote to memory of 1752	2040	ca52d71157eb727bd83428292aae4be86ea5f0d30ef4965baae220437659666a.exe	27
PID 2040 wrote to memory of 1752	2040	ca52d71157eb727bd83428292aae4be86ea5f0d30ef4965baae220437659666a.exe	27
PID 2040 wrote to memory of 1752	2040	ca52d71157eb727bd83428292aae4be86ea5f0d30ef4965baae220437659666a.exe	27
PID 332 wrote to memory of 872	332	csrss.exe	21

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:332

C:\Users\Admin\AppData\Local\Temp\ca52d71157eb727bd83428292aae4be86ea5f0d30ef4965baae220437659666a.exe
"C:\Users\Admin\AppData\Local\Temp\ca52d71157eb727bd83428292aae4be86ea5f0d30ef4965baae220437659666a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Deletes itself
  PID:1752

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32\consrv.dll

Filesize
52KB

MD5
6bf2039986af96d98e08824ac6c383fd

SHA1
0bb6384656a96943cb427baa92446f987219a02e

SHA256
a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

SHA512
fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

Download Submit
\??\globalroot\systemroot\assembly\temp\@

Filesize
2KB

MD5
2f110607d3e28f32a1af074f4aab1f82

SHA1
2dbf6d08922d1d3746947fccd2593c21d9d7105f

SHA256
d5aede5beacdda9cc17061c8ae15bbb17350c1a5edf396ea30b6fbef539d64bb

SHA512
e9338f8bada30b97c556d624271a1aa90085dcef6d0855b291fadef4330f633ea3d9ea95b6a73c431fdf0efb6981725cda9e7806ed1f00fa9310639eaecf1059

Download Submit
\Windows\System32\consrv.dll

Filesize
52KB

MD5
6bf2039986af96d98e08824ac6c383fd

SHA1
0bb6384656a96943cb427baa92446f987219a02e

SHA256
a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

SHA512
fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

Download Submit
memory/332-70-0x0000000001EB0000-0x0000000001EC1000-memory.dmp

Filesize
68KB

Download
memory/332-69-0x0000000001EB0000-0x0000000001EC1000-memory.dmp

Filesize
68KB

Download
memory/872-81-0x0000000000840000-0x000000000084B000-memory.dmp

Filesize
44KB

Download
memory/872-83-0x0000000000830000-0x0000000000838000-memory.dmp

Filesize
32KB

Download
memory/872-86-0x0000000000850000-0x000000000085B000-memory.dmp

Filesize
44KB

Download
memory/872-85-0x0000000000830000-0x0000000000838000-memory.dmp

Filesize
32KB

Download
memory/872-77-0x0000000000840000-0x000000000084B000-memory.dmp

Filesize
44KB

Download
memory/872-73-0x0000000000840000-0x000000000084B000-memory.dmp

Filesize
44KB

Download
memory/872-84-0x0000000000850000-0x000000000085B000-memory.dmp

Filesize
44KB

Download
memory/1212-57-0x0000000002610000-0x0000000002616000-memory.dmp

Filesize
24KB

Download
memory/1212-61-0x0000000002610000-0x0000000002616000-memory.dmp

Filesize
24KB

Download
memory/1212-65-0x0000000002610000-0x0000000002616000-memory.dmp

Filesize
24KB

Download
memory/1752-71-0x0000000000000000-mapping.dmp

Download
memory/2040-72-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2040-56-0x0000000000230000-0x0000000000266000-memory.dmp

Filesize
216KB

Download
memory/2040-54-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download
memory/2040-66-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2040-55-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing