5e41733abb235fc64aefb602fb1273710ce13fbec471f0535688895f3a0462f4

General

Target

1ea9c0ea0563f7681e6f6519f070f079.exe
Size

171KB
MD5

1ea9c0ea0563f7681e6f6519f070f079
SHA1

82a759652adfafd0213d57ef04b41d26a88e6fd8
SHA256

5e41733abb235fc64aefb602fb1273710ce13fbec471f0535688895f3a0462f4
SHA512

18b716087d495a2d658a6a2d56cd3867238ce6b3fd6056ea738c1b9602b4c42874ab2b5d755ffc2514eace57ee94b5a1a61fb1a618d577ec0b1a2bf1d3828e20
SSDEEP

3072:Z7n6GvsLTBwPAeVACQbUUawBpc38YxmS8zm00odMyB5q101cGn7twmDDhJW:ZTHowYgJQbUUo3fxF8zmzox7l1cG5wmH

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2700	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
336	csrss.exe

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3044 set thread context of 2700	3044	1ea9c0ea0563f7681e6f6519f070f079.exe	28

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3044	1ea9c0ea0563f7681e6f6519f070f079.exe
3044	1ea9c0ea0563f7681e6f6519f070f079.exe
3044	1ea9c0ea0563f7681e6f6519f070f079.exe
3044	1ea9c0ea0563f7681e6f6519f070f079.exe
336	csrss.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3044	1ea9c0ea0563f7681e6f6519f070f079.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3044	1ea9c0ea0563f7681e6f6519f070f079.exe
Token: SeDebugPrivilege	3044	1ea9c0ea0563f7681e6f6519f070f079.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
336	csrss.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 1300	3044	1ea9c0ea0563f7681e6f6519f070f079.exe	6
PID 3044 wrote to memory of 336	3044	1ea9c0ea0563f7681e6f6519f070f079.exe	26
PID 3044 wrote to memory of 2700	3044	1ea9c0ea0563f7681e6f6519f070f079.exe	28
PID 3044 wrote to memory of 2700	3044	1ea9c0ea0563f7681e6f6519f070f079.exe	28
PID 3044 wrote to memory of 2700	3044	1ea9c0ea0563f7681e6f6519f070f079.exe	28
PID 3044 wrote to memory of 2700	3044	1ea9c0ea0563f7681e6f6519f070f079.exe	28
PID 3044 wrote to memory of 2700	3044	1ea9c0ea0563f7681e6f6519f070f079.exe	28
PID 336 wrote to memory of 2304	336	csrss.exe	30
PID 336 wrote to memory of 2304	336	csrss.exe	30
PID 336 wrote to memory of 768	336	csrss.exe	31
PID 336 wrote to memory of 768	336	csrss.exe	31
PID 336 wrote to memory of 848	336	csrss.exe	14

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1300
- C:\Users\Admin\AppData\Local\Temp\1ea9c0ea0563f7681e6f6519f070f079.exe
  "C:\Users\Admin\AppData\Local\Temp\1ea9c0ea0563f7681e6f6519f070f079.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:2700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:848
- C:\Windows\system32\wbem\WMIADAP.EXE
  wmiadap.exe /F /T /R
  2⤵
  PID:2304

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:336

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32\consrv.dll

Filesize
52KB

MD5
6bf2039986af96d98e08824ac6c383fd

SHA1
0bb6384656a96943cb427baa92446f987219a02e

SHA256
a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

SHA512
fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

Download Submit
\??\globalroot\systemroot\assembly\temp\@

Filesize
2KB

MD5
f55dfa740d236101c1d685c665634c1b

SHA1
98bf9d13455419b723154027f62b873f99dac5c9

SHA256
607fec0154a69d3a6a783d853e9c1e9bffba304cc9285910121e8835ec7af1f8

SHA512
c9f6ff5bae8e67d0fbc95a30d1252b6883f3726259c2316fb4ede6c7f96d861d2ef42b18fd5d85c0ae26fa1a3c0279871fcf4ec6307b35b643844242f917b84c

Download Submit
memory/336-31-0x0000000000AB0000-0x0000000000AC1000-memory.dmp

Filesize
68KB

Download
memory/336-22-0x0000000002690000-0x0000000002692000-memory.dmp

Filesize
8KB

Download
memory/336-23-0x0000000000AB0000-0x0000000000AC1000-memory.dmp

Filesize
68KB

Download
memory/336-21-0x0000000000AB0000-0x0000000000AC1000-memory.dmp

Filesize
68KB

Download
memory/336-30-0x0000000002690000-0x0000000002692000-memory.dmp

Filesize
8KB

Download
memory/848-34-0x0000000000930000-0x0000000000938000-memory.dmp

Filesize
32KB

Download
memory/848-38-0x0000000000940000-0x000000000094B000-memory.dmp

Filesize
44KB

Download
memory/848-42-0x0000000000940000-0x000000000094B000-memory.dmp

Filesize
44KB

Download
memory/848-43-0x0000000000950000-0x000000000095B000-memory.dmp

Filesize
44KB

Download
memory/848-45-0x0000000000950000-0x000000000095B000-memory.dmp

Filesize
44KB

Download
memory/848-33-0x0000000000940000-0x000000000094B000-memory.dmp

Filesize
44KB

Download
memory/848-46-0x0000000000930000-0x0000000000938000-memory.dmp

Filesize
32KB

Download
memory/848-47-0x0000000000950000-0x000000000095B000-memory.dmp

Filesize
44KB

Download
memory/1300-14-0x00000000026A0000-0x00000000026A6000-memory.dmp

Filesize
24KB

Download
memory/1300-6-0x00000000026A0000-0x00000000026A6000-memory.dmp

Filesize
24KB

Download
memory/1300-10-0x00000000026A0000-0x00000000026A6000-memory.dmp

Filesize
24KB

Download
memory/1300-15-0x0000000002690000-0x0000000002692000-memory.dmp

Filesize
8KB

Download
memory/3044-29-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3044-27-0x00000000001C0000-0x0000000000201000-memory.dmp

Filesize
260KB

Download
memory/3044-26-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3044-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/3044-5-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3044-4-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/3044-3-0x00000000001C0000-0x0000000000201000-memory.dmp

Filesize
260KB

Download
memory/3044-2-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3044-1-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing