95f3bedbe8eab49d6ecbe022dc465d281e4ea91b69807859c3dc6a375b2d89a9

General

Target

95f3bedbe8eab49d6ecbe022dc465d281e4ea91b69807859c3dc6a375b2d89a9.exe
Size

206KB
MD5

815d2b15498f88239ae8557655c62609
SHA1

d0a181764abd86f8a1bf9736cd5a7b29f842dc93
SHA256

95f3bedbe8eab49d6ecbe022dc465d281e4ea91b69807859c3dc6a375b2d89a9
SHA512

1d5c5d813558e81b429a6cc232c2f93c590fc4e651676dff441fd873c6e92fa80b07cf55b011921047ab699178d870e90bc0e04d906e89a6b3b8fe12d398f835
SSDEEP

6144:1BC1Q7cIkNzakJen1IwtVKeKy23y0I6Q1hM:1BC1Q7NEWkJen1I8VJKy2i0fAh

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
332	csrss.exe

Deletes itself 1 IoCs

pid	Process
1748	cmd.exe

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1652 set thread context of 1748	1652	95f3bedbe8eab49d6ecbe022dc465d281e4ea91b69807859c3dc6a375b2d89a9.exe	27

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1652	95f3bedbe8eab49d6ecbe022dc465d281e4ea91b69807859c3dc6a375b2d89a9.exe
1652	95f3bedbe8eab49d6ecbe022dc465d281e4ea91b69807859c3dc6a375b2d89a9.exe
1652	95f3bedbe8eab49d6ecbe022dc465d281e4ea91b69807859c3dc6a375b2d89a9.exe
1652	95f3bedbe8eab49d6ecbe022dc465d281e4ea91b69807859c3dc6a375b2d89a9.exe
332	csrss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1652	95f3bedbe8eab49d6ecbe022dc465d281e4ea91b69807859c3dc6a375b2d89a9.exe
Token: SeDebugPrivilege	1652	95f3bedbe8eab49d6ecbe022dc465d281e4ea91b69807859c3dc6a375b2d89a9.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1276	Explorer.EXE
1276	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1276	Explorer.EXE
1276	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
332	csrss.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1276	1652	95f3bedbe8eab49d6ecbe022dc465d281e4ea91b69807859c3dc6a375b2d89a9.exe	11
PID 1652 wrote to memory of 332	1652	95f3bedbe8eab49d6ecbe022dc465d281e4ea91b69807859c3dc6a375b2d89a9.exe	24
PID 1652 wrote to memory of 1748	1652	95f3bedbe8eab49d6ecbe022dc465d281e4ea91b69807859c3dc6a375b2d89a9.exe	27
PID 1652 wrote to memory of 1748	1652	95f3bedbe8eab49d6ecbe022dc465d281e4ea91b69807859c3dc6a375b2d89a9.exe	27
PID 1652 wrote to memory of 1748	1652	95f3bedbe8eab49d6ecbe022dc465d281e4ea91b69807859c3dc6a375b2d89a9.exe	27
PID 1652 wrote to memory of 1748	1652	95f3bedbe8eab49d6ecbe022dc465d281e4ea91b69807859c3dc6a375b2d89a9.exe	27
PID 1652 wrote to memory of 1748	1652	95f3bedbe8eab49d6ecbe022dc465d281e4ea91b69807859c3dc6a375b2d89a9.exe	27
PID 332 wrote to memory of 860	332	csrss.exe	16

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1276
- C:\Users\Admin\AppData\Local\Temp\95f3bedbe8eab49d6ecbe022dc465d281e4ea91b69807859c3dc6a375b2d89a9.exe
  "C:\Users\Admin\AppData\Local\Temp\95f3bedbe8eab49d6ecbe022dc465d281e4ea91b69807859c3dc6a375b2d89a9.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:1748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:860

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32\consrv.dll

Filesize
52KB

MD5
6bf2039986af96d98e08824ac6c383fd

SHA1
0bb6384656a96943cb427baa92446f987219a02e

SHA256
a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

SHA512
fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

Download Submit
\??\globalroot\systemroot\assembly\temp\@

Filesize
2KB

MD5
3183fc8078f5efc221a65cc26fbcb8a4

SHA1
ce90f8da41f455ea49fb4fbc85e559af6f7d14c6

SHA256
b5589167fad34d3a5e7bc5791ac3f542449191a8233f078e804e1c396b92cfc4

SHA512
cb7640ec3e4558188e195c030a5f190d7ca3899947899229f1f2f656bfc568e1eef70db934167d16f49eb1b195a517761ee4434856e997e105fe7ca1a7ebd260

Download Submit
\Windows\System32\consrv.dll

Filesize
52KB

MD5
6bf2039986af96d98e08824ac6c383fd

SHA1
0bb6384656a96943cb427baa92446f987219a02e

SHA256
a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

SHA512
fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

Download Submit
memory/332-69-0x0000000001EF0000-0x0000000001F01000-memory.dmp

Filesize
68KB

Download
memory/860-76-0x0000000000340000-0x000000000034B000-memory.dmp

Filesize
44KB

Download
memory/860-85-0x0000000000350000-0x000000000035B000-memory.dmp

Filesize
44KB

Download
memory/860-84-0x0000000000330000-0x0000000000338000-memory.dmp

Filesize
32KB

Download
memory/860-83-0x0000000000350000-0x000000000035B000-memory.dmp

Filesize
44KB

Download
memory/860-82-0x0000000000330000-0x0000000000338000-memory.dmp

Filesize
32KB

Download
memory/860-72-0x0000000000340000-0x000000000034B000-memory.dmp

Filesize
44KB

Download
memory/860-80-0x0000000000340000-0x000000000034B000-memory.dmp

Filesize
44KB

Download
memory/1276-57-0x0000000002A00000-0x0000000002A06000-memory.dmp

Filesize
24KB

Download
memory/1276-61-0x0000000002A00000-0x0000000002A06000-memory.dmp

Filesize
24KB

Download
memory/1276-65-0x0000000002A00000-0x0000000002A06000-memory.dmp

Filesize
24KB

Download
memory/1652-71-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1652-66-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1652-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/1652-56-0x00000000003B0000-0x00000000003F6000-memory.dmp

Filesize
280KB

Download
memory/1652-55-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download

Analysis

Sharing