a9a9641d362dae5a6e749899444bdcefa130244dbd26921535e885a5bd2c34d2

General

Target

a9a9641d362dae5a6e749899444bdcefa130244dbd26921535e885a5bd2c34d2.exe
Size

176KB
MD5

42fa32df9ec5b6e05e7e13a21ae59664
SHA1

71306203f2539152a6c55d9d32d1548496a7e0fa
SHA256

a9a9641d362dae5a6e749899444bdcefa130244dbd26921535e885a5bd2c34d2
SHA512

4489da20a1f10d83cb23bdaae4dcbeeec0b01f3a12916e12660529b3e3d9f2d32a61992a08e7796bfc352793bf960af6cb86fc586c361d2e16b3595986f10653
SSDEEP

3072:D7VsO4IucgqMc6CFJtx94gKVupO/nrMBqCqa5liyTF10Cd3oe1goYc:3Vz4vPqWCHHKVD/gqba5liu10CdN+nc

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3604	csrss.exe
4012	windows.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Local\Temp\a9a9641d362dae5a6e749899444bdcefa130244dbd26921535e885a5bd2c34d2.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a9a9641d362dae5a6e749899444bdcefa130244dbd26921535e885a5bd2c34d2.exe"	a9a9641d362dae5a6e749899444bdcefa130244dbd26921535e885a5bd2c34d2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\C:\WINDOWS\system\csrss.exe = "C:\\WINDOWS\\system\\csrss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\C:\WINDOWS\system\windows.exe = "C:\\WINDOWS\\system\\windows.exe"	windows.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\system\windows.exe	a9a9641d362dae5a6e749899444bdcefa130244dbd26921535e885a5bd2c34d2.exe
File created	C:\WINDOWS\system\windows.exe	csrss.exe
File opened for modification	C:\Windows\System\windows.exe	windows.exe
File created	C:\WINDOWS\system\windows.exe	a9a9641d362dae5a6e749899444bdcefa130244dbd26921535e885a5bd2c34d2.exe
File created	C:\WINDOWS\system\csrss.exe	a9a9641d362dae5a6e749899444bdcefa130244dbd26921535e885a5bd2c34d2.exe
File created	C:\WINDOWS\system\csrss.exe	csrss.exe
File opened for modification	C:\Windows\System\csrss.exe	csrss.exe
File created	C:\WINDOWS\system\windows.exe	windows.exe
File created	C:\WINDOWS\system\csrss.exe	windows.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1436	a9a9641d362dae5a6e749899444bdcefa130244dbd26921535e885a5bd2c34d2.exe
1436	a9a9641d362dae5a6e749899444bdcefa130244dbd26921535e885a5bd2c34d2.exe
3604	csrss.exe
3604	csrss.exe
4012	windows.exe
4012	windows.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 3604	1436	a9a9641d362dae5a6e749899444bdcefa130244dbd26921535e885a5bd2c34d2.exe	83
PID 1436 wrote to memory of 3604	1436	a9a9641d362dae5a6e749899444bdcefa130244dbd26921535e885a5bd2c34d2.exe	83
PID 1436 wrote to memory of 3604	1436	a9a9641d362dae5a6e749899444bdcefa130244dbd26921535e885a5bd2c34d2.exe	83
PID 1436 wrote to memory of 4012	1436	a9a9641d362dae5a6e749899444bdcefa130244dbd26921535e885a5bd2c34d2.exe	84
PID 1436 wrote to memory of 4012	1436	a9a9641d362dae5a6e749899444bdcefa130244dbd26921535e885a5bd2c34d2.exe	84
PID 1436 wrote to memory of 4012	1436	a9a9641d362dae5a6e749899444bdcefa130244dbd26921535e885a5bd2c34d2.exe	84

C:\Users\Admin\AppData\Local\Temp\a9a9641d362dae5a6e749899444bdcefa130244dbd26921535e885a5bd2c34d2.exe
"C:\Users\Admin\AppData\Local\Temp\a9a9641d362dae5a6e749899444bdcefa130244dbd26921535e885a5bd2c34d2.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1436
- C:\WINDOWS\system\csrss.exe
  "C:\WINDOWS\system\csrss.exe" /para
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:3604
- C:\WINDOWS\system\windows.exe
  "C:\WINDOWS\system\windows.exe" /para
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\system\csrss.exe

Filesize
176KB

MD5
42fa32df9ec5b6e05e7e13a21ae59664

SHA1
71306203f2539152a6c55d9d32d1548496a7e0fa

SHA256
a9a9641d362dae5a6e749899444bdcefa130244dbd26921535e885a5bd2c34d2

SHA512
4489da20a1f10d83cb23bdaae4dcbeeec0b01f3a12916e12660529b3e3d9f2d32a61992a08e7796bfc352793bf960af6cb86fc586c361d2e16b3595986f10653

Download Submit
C:\WINDOWS\system\windows.exe

Filesize
176KB

MD5
42fa32df9ec5b6e05e7e13a21ae59664

SHA1
71306203f2539152a6c55d9d32d1548496a7e0fa

SHA256
a9a9641d362dae5a6e749899444bdcefa130244dbd26921535e885a5bd2c34d2

SHA512
4489da20a1f10d83cb23bdaae4dcbeeec0b01f3a12916e12660529b3e3d9f2d32a61992a08e7796bfc352793bf960af6cb86fc586c361d2e16b3595986f10653

Download Submit
C:\Windows\System\csrss.exe

Filesize
176KB

MD5
42fa32df9ec5b6e05e7e13a21ae59664

SHA1
71306203f2539152a6c55d9d32d1548496a7e0fa

SHA256
a9a9641d362dae5a6e749899444bdcefa130244dbd26921535e885a5bd2c34d2

SHA512
4489da20a1f10d83cb23bdaae4dcbeeec0b01f3a12916e12660529b3e3d9f2d32a61992a08e7796bfc352793bf960af6cb86fc586c361d2e16b3595986f10653

Download Submit
C:\Windows\System\windows.exe

Filesize
176KB

MD5
42fa32df9ec5b6e05e7e13a21ae59664

SHA1
71306203f2539152a6c55d9d32d1548496a7e0fa

SHA256
a9a9641d362dae5a6e749899444bdcefa130244dbd26921535e885a5bd2c34d2

SHA512
4489da20a1f10d83cb23bdaae4dcbeeec0b01f3a12916e12660529b3e3d9f2d32a61992a08e7796bfc352793bf960af6cb86fc586c361d2e16b3595986f10653

Download Submit
memory/1436-132-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1436-139-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3604-140-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4012-141-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing