4cb5267b98f2b0e93b25f25286be56348ccca3a6fde3d654e9407dca7b3f558d

General

Target

Girlz HIGH 2010 09 22 GRAVURE GALLERY.exe
Size

206KB
MD5

de38f5b6f3d2e04dc4294b7779d8ac8b
SHA1

afb3506d319eb72267278c97706cee337e49dec5
SHA256

d14a715363f5740ec381210ac4a4b407fe4565734ede0824f70486b42044f14a
SHA512

4e48d70d9c3d9531e8ac8cb7cb02195d60026a022eb9e8128e01ed19494978009d6747dc3af069d6c041a05f5af439cd39a233eb1d5ff8f65a750b2c919fe99e
SSDEEP

3072:jZpIdiV+fJKIQHJ/66e0KEplqZqM9YzkPgqeKKOrCvhDlkdQ9vnH6Ba75CH/ZG:oE+fUIU/4vaM9YQPgFKKOY79r75CfM

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2236	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
336	csrss.exe

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2452 set thread context of 2236	2452	Girlz HIGH 2010 09 22 GRAVURE GALLERY.exe	28

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2452	Girlz HIGH 2010 09 22 GRAVURE GALLERY.exe
2452	Girlz HIGH 2010 09 22 GRAVURE GALLERY.exe
2452	Girlz HIGH 2010 09 22 GRAVURE GALLERY.exe
2452	Girlz HIGH 2010 09 22 GRAVURE GALLERY.exe
336	csrss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2452	Girlz HIGH 2010 09 22 GRAVURE GALLERY.exe
Token: SeDebugPrivilege	2452	Girlz HIGH 2010 09 22 GRAVURE GALLERY.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
336	csrss.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 1140	2452	Girlz HIGH 2010 09 22 GRAVURE GALLERY.exe	8
PID 2452 wrote to memory of 336	2452	Girlz HIGH 2010 09 22 GRAVURE GALLERY.exe	26
PID 2452 wrote to memory of 2236	2452	Girlz HIGH 2010 09 22 GRAVURE GALLERY.exe	28
PID 2452 wrote to memory of 2236	2452	Girlz HIGH 2010 09 22 GRAVURE GALLERY.exe	28
PID 2452 wrote to memory of 2236	2452	Girlz HIGH 2010 09 22 GRAVURE GALLERY.exe	28
PID 2452 wrote to memory of 2236	2452	Girlz HIGH 2010 09 22 GRAVURE GALLERY.exe	28
PID 2452 wrote to memory of 2236	2452	Girlz HIGH 2010 09 22 GRAVURE GALLERY.exe	28
PID 336 wrote to memory of 2600	336	csrss.exe	30
PID 336 wrote to memory of 2600	336	csrss.exe	30
PID 336 wrote to memory of 2056	336	csrss.exe	31
PID 336 wrote to memory of 2056	336	csrss.exe	31
PID 336 wrote to memory of 852	336	csrss.exe	16

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1140
- C:\Users\Admin\AppData\Local\Temp\Girlz HIGH 2010 09 22 GRAVURE GALLERY.exe
  "C:\Users\Admin\AppData\Local\Temp\Girlz HIGH 2010 09 22 GRAVURE GALLERY.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:2236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:852
- C:\Windows\system32\wbem\WMIADAP.EXE
  wmiadap.exe /F /T /R
  2⤵
  PID:2600

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:336

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:2056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\??\globalroot\systemroot\assembly\temp\@

Filesize
2KB

MD5
56984659c50ef1a7574b37d7571686e1

SHA1
a90b6669f0b233ff2231fc343aa961c5addb1a0a

SHA256
a1a5f669bb57441fdf48705424d97d8744abd931d50ccdc2c39b60a8c0ecad68

SHA512
bc4b744d0d7e7bdd3c635ccbf8ae92c3c60155e35e89dd267cbd73caecedfc1579146fc0fbbc74abcf90a61540e83d150fd93a8b508f0963d03baba238e7ad20

Download Submit
memory/336-29-0x0000000002590000-0x0000000002592000-memory.dmp

Filesize
8KB

Download
memory/336-22-0x0000000000E80000-0x0000000000E91000-memory.dmp

Filesize
68KB

Download
memory/336-21-0x0000000000E80000-0x0000000000E91000-memory.dmp

Filesize
68KB

Download
memory/336-30-0x0000000000E80000-0x0000000000E91000-memory.dmp

Filesize
68KB

Download
memory/852-45-0x0000000000BE0000-0x0000000000BEB000-memory.dmp

Filesize
44KB

Download
memory/852-33-0x0000000000BC0000-0x0000000000BC8000-memory.dmp

Filesize
32KB

Download
memory/852-37-0x0000000000BD0000-0x0000000000BDB000-memory.dmp

Filesize
44KB

Download
memory/852-41-0x0000000000BD0000-0x0000000000BDB000-memory.dmp

Filesize
44KB

Download
memory/852-42-0x0000000000BE0000-0x0000000000BEB000-memory.dmp

Filesize
44KB

Download
memory/852-44-0x0000000000BE0000-0x0000000000BEB000-memory.dmp

Filesize
44KB

Download
memory/852-32-0x0000000000BD0000-0x0000000000BDB000-memory.dmp

Filesize
44KB

Download
memory/1140-15-0x0000000002590000-0x0000000002592000-memory.dmp

Filesize
8KB

Download
memory/1140-6-0x00000000025A0000-0x00000000025A6000-memory.dmp

Filesize
24KB

Download
memory/1140-10-0x00000000025A0000-0x00000000025A6000-memory.dmp

Filesize
24KB

Download
memory/1140-14-0x00000000025A0000-0x00000000025A6000-memory.dmp

Filesize
24KB

Download
memory/2452-26-0x00000000005E0000-0x0000000000626000-memory.dmp

Filesize
280KB

Download
memory/2452-28-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2452-25-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2452-1-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2452-5-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2452-0-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2452-2-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2452-3-0x00000000005E0000-0x0000000000626000-memory.dmp

Filesize
280KB

Download
memory/2452-4-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing