Behavioral Report

Analysis

max time kernel
143s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2023 13:59

Sharing

Copy URL

Twitter E-mail

Report Files Registry Network Processes Mutex Misc

General

Target

e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Size

3MB
MD5

e2ca05a8660366902950f41661af559c
SHA1

f284653a4b995897e6a715a0b777967523202070
SHA256

e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c
SHA512

e3537e782be1aa906c23be3e65680ac8563b766e63bbdb688eea2c62d4144d481f80257fab2a29bf7e9a2d8ff0747226189573e551ebfa24acb35728241b320e
SSDEEP

98304:/ReGuQ8kHOnYvSKhKNLwCErpijireyuBRmsazY:/0GemSkKNLFnj2wBcs

Score

10^/10

glupteba discovery dropper evasion loader persistence upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Suspicious use of NtCreateUserProcessOtherParentProcess 6 IoCs

Processes:

svchost.exe

description	pid	process	target process
PID 3136 created 4700	3136	svchost.exe	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
PID 3136 created 1320	3136	svchost.exe	csrss.exe
PID 3136 created 1320	3136	svchost.exe	csrss.exe
PID 3136 created 1320	3136	svchost.exe	csrss.exe
PID 3136 created 1544	3136	svchost.exe	f801950a962ddba14caaa44bf084b55c.exe
PID 3136 created 1544	3136	svchost.exe	f801950a962ddba14caaa44bf084b55c.exe

Executes dropped EXE 3 IoCs

Processes:

csrss.exeinjector.exef801950a962ddba14caaa44bf084b55c.exe

pid process

1320 csrss.exe
1756 injector.exe
1544 f801950a962ddba14caaa44bf084b55c.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

TTPs:

Modify Existing Service

Processes:

netsh.exe

pid process

532 netsh.exe

pid	process
1320	csrss.exe
1756	injector.exe
1544	f801950a962ddba14caaa44bf084b55c.exe

pid	process
532	netsh.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/files/0x00110000000162a6-155.dat	upx
behavioral1/files/0x00110000000162a6-156.dat	upx
behavioral1/memory/1544-157-0x0000000000400000-0x0000000000C25000-memory.dmp	upx
behavioral1/memory/1544-161-0x0000000000400000-0x0000000000C25000-memory.dmp	upx
behavioral1/memory/1544-163-0x0000000000400000-0x0000000000C25000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

TTPs:

Registry Run Keys / Startup Folder Modify Registry

Processes:

e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.execsrss.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

TTPs:

Query Registry
Legitimate hosting services abused for malware hosting/C2 1 TTPs

TTPs:

Web Service

Drops file in Windows directory 2 IoCs

Processes:

e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe

description	ioc	process
File opened for modification	C:\Windows\rss	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
File created	C:\Windows\rss\csrss.exe	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

TTPs:

Scheduled Task

Processes:

schtasks.exeschtasks.exe

pid process

4368 schtasks.exe
4048 schtasks.exe

pid	process
4368	schtasks.exe
4048	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.execsrss.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time"	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exee98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exeinjector.execsrss.exe

pid	process
4700	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
4700	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
2876	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
2876	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
2876	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
2876	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
2876	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
2876	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
2876	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
2876	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
2876	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
2876	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1320	csrss.exe
1320	csrss.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1320	csrss.exe
1320	csrss.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe
1756	injector.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

Processes:

e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exesvchost.execsrss.exe

description	pid	process
Token: SeDebugPrivilege	4700	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Token: SeImpersonatePrivilege	4700	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
Token: SeTcbPrivilege	3136	svchost.exe
Token: SeTcbPrivilege	3136	svchost.exe
Token: SeBackupPrivilege	3136	svchost.exe
Token: SeRestorePrivilege	3136	svchost.exe
Token: SeBackupPrivilege	3136	svchost.exe
Token: SeRestorePrivilege	3136	svchost.exe
Token: SeBackupPrivilege	3136	svchost.exe
Token: SeRestorePrivilege	3136	svchost.exe
Token: SeBackupPrivilege	3136	svchost.exe
Token: SeRestorePrivilege	3136	svchost.exe
Token: SeSystemEnvironmentPrivilege	1320	csrss.exe
Token: SeBackupPrivilege	3136	svchost.exe
Token: SeRestorePrivilege	3136	svchost.exe
Token: SeBackupPrivilege	3136	svchost.exe
Token: SeRestorePrivilege	3136	svchost.exe
Token: SeBackupPrivilege	3136	svchost.exe
Token: SeRestorePrivilege	3136	svchost.exe
Token: SeBackupPrivilege	3136	svchost.exe
Token: SeRestorePrivilege	3136	svchost.exe
Token: SeBackupPrivilege	3136	svchost.exe
Token: SeRestorePrivilege	3136	svchost.exe
Token: SeBackupPrivilege	3136	svchost.exe
Token: SeRestorePrivilege	3136	svchost.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

svchost.exee98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.execmd.execsrss.exe

description	pid	process	target process
PID 3136 wrote to memory of 2876	3136	svchost.exe	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
PID 3136 wrote to memory of 2876	3136	svchost.exe	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
PID 3136 wrote to memory of 2876	3136	svchost.exe	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe
PID 2876 wrote to memory of 4128	2876	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe	cmd.exe
PID 2876 wrote to memory of 4128	2876	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe	cmd.exe
PID 4128 wrote to memory of 532	4128	cmd.exe	netsh.exe
PID 4128 wrote to memory of 532	4128	cmd.exe	netsh.exe
PID 2876 wrote to memory of 1320	2876	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe	csrss.exe
PID 2876 wrote to memory of 1320	2876	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe	csrss.exe
PID 2876 wrote to memory of 1320	2876	e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe	csrss.exe
PID 3136 wrote to memory of 4368	3136	svchost.exe	schtasks.exe
PID 3136 wrote to memory of 4368	3136	svchost.exe	schtasks.exe
PID 3136 wrote to memory of 3756	3136	svchost.exe	schtasks.exe
PID 3136 wrote to memory of 3756	3136	svchost.exe	schtasks.exe
PID 1320 wrote to memory of 1756	1320	csrss.exe	injector.exe
PID 1320 wrote to memory of 1756	1320	csrss.exe	injector.exe
PID 3136 wrote to memory of 4048	3136	svchost.exe	schtasks.exe
PID 3136 wrote to memory of 4048	3136	svchost.exe	schtasks.exe
PID 1320 wrote to memory of 1544	1320	csrss.exe	f801950a962ddba14caaa44bf084b55c.exe
PID 1320 wrote to memory of 1544	1320	csrss.exe	f801950a962ddba14caaa44bf084b55c.exe
PID 1320 wrote to memory of 1544	1320	csrss.exe	f801950a962ddba14caaa44bf084b55c.exe
PID 3136 wrote to memory of 908	3136	svchost.exe	schtasks.exe
PID 3136 wrote to memory of 908	3136	svchost.exe	schtasks.exe
PID 3136 wrote to memory of 964	3136	svchost.exe	schtasks.exe
PID 3136 wrote to memory of 964	3136	svchost.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe

"C:\Users\Admin\AppData\Local\Temp\e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe"

Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken

PID:4700

C:\Users\Admin\AppData\Local\Temp\e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe

"C:\Users\Admin\AppData\Local\Temp\e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c.exe"

Adds Run key to start application
Drops file in Windows directory
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory

PID:2876

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

Suspicious use of WriteProcessMemory

PID:4128

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

Modifies Windows Firewall

PID:532

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

Executes dropped EXE
Adds Run key to start application
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory

PID:1320

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

Creates scheduled task(s)

PID:4368

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

PID:3756

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

Executes dropped EXE
Suspicious behavior: EnumeratesProcesses

PID:1756

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

Creates scheduled task(s)

PID:4048

C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe

C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe

Executes dropped EXE

PID:1544

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn "csrss" /f

PID:908

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn "ScheduledUpdate" /f

PID:964

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon

Suspicious use of NtCreateUserProcessOtherParentProcess
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory

PID:3136

Network

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Web Service

T1102

Modify Registry

T1112

Discovery

Query Registry

T1012

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Replay Monitor

00:00 00:00

Downloads

C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe
Filesize
3MB

MD5
f801950a962ddba14caaa44bf084b55c

SHA1
7cadc9076121297428442785536ba0df2d4ae996

SHA256
c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f

SHA512
4183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe
Filesize
3MB

MD5
f801950a962ddba14caaa44bf084b55c

SHA1
7cadc9076121297428442785536ba0df2d4ae996

SHA256
c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f

SHA512
4183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
Filesize
99KB

MD5
09031a062610d77d685c9934318b4170

SHA1
880f744184e7774f3d14c1bb857e21cc7fe89a6d

SHA256
778bd69af403df3c4e074c31b3850d71bf0e64524bea4272a802ca9520b379dd

SHA512
9a276e1f0f55d35f2bf38eb093464f7065bdd30a660e6d1c62eed5e76d1fb2201567b89d9ae65d2d89dc99b142159e36fb73be8d5e08252a975d50544a7cda27

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Windows\rss\csrss.exe
Filesize
3MB

MD5
e2ca05a8660366902950f41661af559c

SHA1
f284653a4b995897e6a715a0b777967523202070

SHA256
e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c

SHA512
e3537e782be1aa906c23be3e65680ac8563b766e63bbdb688eea2c62d4144d481f80257fab2a29bf7e9a2d8ff0747226189573e551ebfa24acb35728241b320e

Download Submit
C:\Windows\rss\csrss.exe
Filesize
3MB

MD5
e2ca05a8660366902950f41661af559c

SHA1
f284653a4b995897e6a715a0b777967523202070

SHA256
e98ae74a9786e95013ea0efa195122e1bbd31d61008e0a1448c5405dc5bacb9c

SHA512
e3537e782be1aa906c23be3e65680ac8563b766e63bbdb688eea2c62d4144d481f80257fab2a29bf7e9a2d8ff0747226189573e551ebfa24acb35728241b320e

Download Submit
memory/532-138-0x0000000000000000-mapping.dmp

Download
memory/908-159-0x0000000000000000-mapping.dmp

Download
memory/964-160-0x0000000000000000-mapping.dmp

Download
memory/1320-153-0x0000000000400000-0x0000000000C91000-memory.dmp

Filesize
8MB

Download
memory/1320-141-0x0000000000000000-mapping.dmp

Download
memory/1320-145-0x0000000002E00000-0x00000000031E9000-memory.dmp

Filesize
3MB

Download
memory/1320-147-0x0000000000400000-0x0000000000C91000-memory.dmp

Filesize
8MB

Download
memory/1320-158-0x0000000000400000-0x0000000000C91000-memory.dmp

Filesize
8MB

Download
memory/1544-157-0x0000000000400000-0x0000000000C25000-memory.dmp

Filesize
8MB

Download
memory/1544-154-0x0000000000000000-mapping.dmp

Download
memory/1544-161-0x0000000000400000-0x0000000000C25000-memory.dmp

Filesize
8MB

Download
memory/1544-163-0x0000000000400000-0x0000000000C25000-memory.dmp

Filesize
8MB

Download
memory/1756-149-0x0000000000000000-mapping.dmp

Download
memory/2876-140-0x0000000000400000-0x0000000000C91000-memory.dmp

Filesize
8MB

Download
memory/2876-144-0x0000000000400000-0x0000000000C91000-memory.dmp

Filesize
8MB

Download
memory/2876-139-0x0000000002C9F000-0x0000000003088000-memory.dmp

Filesize
3MB

Download
memory/2876-135-0x0000000000000000-mapping.dmp

Download
memory/3756-148-0x0000000000000000-mapping.dmp

Download
memory/4048-152-0x0000000000000000-mapping.dmp

Download
memory/4128-137-0x0000000000000000-mapping.dmp

Download
memory/4368-146-0x0000000000000000-mapping.dmp

Download
memory/4700-132-0x0000000002AEA000-0x0000000002ED3000-memory.dmp

Filesize
3MB

Download
memory/4700-136-0x0000000000400000-0x0000000000C91000-memory.dmp

Filesize
8MB

Download
memory/4700-134-0x0000000000400000-0x0000000000C91000-memory.dmp

Filesize
8MB

Download
memory/4700-133-0x0000000002EE0000-0x0000000003757000-memory.dmp

Filesize
8MB

Download