e50c207ce98d62f2a2abea9651e3baeccebef28d6f0e55d8df34ea63a742d236

General

Target

e50c207ce98d62f2a2abea9651e3baeccebef28d6f0e55d8df34ea63a742d236.exe
Size

217KB
MD5

41f5a09c260f1c53f7d36077fbd61586
SHA1

3708764abb41ee06a7f3d78da8fd6144daa8c0d6
SHA256

e50c207ce98d62f2a2abea9651e3baeccebef28d6f0e55d8df34ea63a742d236
SHA512

fcbb9cdd6ea5b7ebe6027222f50607932311cdd016b49c5d09c0b7c08b3dc717b8fcee81319092e144179a94132771829003a0fb8e481f8904227980ccc3ad0c
SSDEEP

6144:0bH3MhU6sM8fP6SPqRZto4fcvg+xh5Jfq:QH3MhU63SqtbX+

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
332	csrss.exe

Deletes itself 1 IoCs

pid	Process
1748	cmd.exe

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 976 set thread context of 1748	976	e50c207ce98d62f2a2abea9651e3baeccebef28d6f0e55d8df34ea63a742d236.exe	27

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
976	e50c207ce98d62f2a2abea9651e3baeccebef28d6f0e55d8df34ea63a742d236.exe
976	e50c207ce98d62f2a2abea9651e3baeccebef28d6f0e55d8df34ea63a742d236.exe
976	e50c207ce98d62f2a2abea9651e3baeccebef28d6f0e55d8df34ea63a742d236.exe
976	e50c207ce98d62f2a2abea9651e3baeccebef28d6f0e55d8df34ea63a742d236.exe
332	csrss.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	976	e50c207ce98d62f2a2abea9651e3baeccebef28d6f0e55d8df34ea63a742d236.exe
Token: SeDebugPrivilege	976	e50c207ce98d62f2a2abea9651e3baeccebef28d6f0e55d8df34ea63a742d236.exe
Token: SeShutdownPrivilege	1276	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1276	Explorer.EXE
1276	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1276	Explorer.EXE
1276	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
332	csrss.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 976 wrote to memory of 1276	976	e50c207ce98d62f2a2abea9651e3baeccebef28d6f0e55d8df34ea63a742d236.exe	16
PID 976 wrote to memory of 332	976	e50c207ce98d62f2a2abea9651e3baeccebef28d6f0e55d8df34ea63a742d236.exe	6
PID 976 wrote to memory of 1748	976	e50c207ce98d62f2a2abea9651e3baeccebef28d6f0e55d8df34ea63a742d236.exe	27
PID 976 wrote to memory of 1748	976	e50c207ce98d62f2a2abea9651e3baeccebef28d6f0e55d8df34ea63a742d236.exe	27
PID 976 wrote to memory of 1748	976	e50c207ce98d62f2a2abea9651e3baeccebef28d6f0e55d8df34ea63a742d236.exe	27
PID 976 wrote to memory of 1748	976	e50c207ce98d62f2a2abea9651e3baeccebef28d6f0e55d8df34ea63a742d236.exe	27
PID 976 wrote to memory of 1748	976	e50c207ce98d62f2a2abea9651e3baeccebef28d6f0e55d8df34ea63a742d236.exe	27
PID 332 wrote to memory of 860	332	csrss.exe	20

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:332

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1276
- C:\Users\Admin\AppData\Local\Temp\e50c207ce98d62f2a2abea9651e3baeccebef28d6f0e55d8df34ea63a742d236.exe
  "C:\Users\Admin\AppData\Local\Temp\e50c207ce98d62f2a2abea9651e3baeccebef28d6f0e55d8df34ea63a742d236.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:976
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:1748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32\consrv.dll

Filesize
52KB

MD5
6bf2039986af96d98e08824ac6c383fd

SHA1
0bb6384656a96943cb427baa92446f987219a02e

SHA256
a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

SHA512
fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

Download Submit
\??\globalroot\systemroot\assembly\temp\@

Filesize
2KB

MD5
fb61b8f56a82be570e68ae7954c406f8

SHA1
932ad5a04e9c130c5cb66cffb213623755253ef8

SHA256
8a00dff42122a8a7a1b27268d5b475c580fa01639e59cda924f01ea68ce27727

SHA512
b9dcaf903388895190848d3a1fe55bc5c3ff6a740bb478725abba02bb19043634107b80a6f6f5ebd22927db612214ac5c3215e9d0ed8f1a5d0d29743e75fd884

Download Submit
\Windows\System32\consrv.dll

Filesize
52KB

MD5
6bf2039986af96d98e08824ac6c383fd

SHA1
0bb6384656a96943cb427baa92446f987219a02e

SHA256
a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

SHA512
fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

Download Submit
memory/332-68-0x0000000001EF0000-0x0000000001F01000-memory.dmp

Filesize
68KB

Download
memory/860-80-0x0000000000340000-0x000000000034B000-memory.dmp

Filesize
44KB

Download
memory/860-85-0x0000000000350000-0x000000000035B000-memory.dmp

Filesize
44KB

Download
memory/860-84-0x0000000000330000-0x0000000000338000-memory.dmp

Filesize
32KB

Download
memory/860-83-0x0000000000350000-0x000000000035B000-memory.dmp

Filesize
44KB

Download
memory/860-82-0x0000000000330000-0x0000000000338000-memory.dmp

Filesize
32KB

Download
memory/860-72-0x0000000000340000-0x000000000034B000-memory.dmp

Filesize
44KB

Download
memory/860-76-0x0000000000340000-0x000000000034B000-memory.dmp

Filesize
44KB

Download
memory/976-64-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/976-71-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/976-69-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/976-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/976-65-0x0000000000230000-0x000000000026E000-memory.dmp

Filesize
248KB

Download
memory/1276-55-0x0000000002A00000-0x0000000002A06000-memory.dmp

Filesize
24KB

Download
memory/1276-63-0x0000000002A00000-0x0000000002A06000-memory.dmp

Filesize
24KB

Download
memory/1276-59-0x0000000002A00000-0x0000000002A06000-memory.dmp

Filesize
24KB

Download
memory/1748-70-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing