6e4ee8588b8409805396726ce7d9bc00f51bfb84fd2dc986b6b68c211edc74fa

General

Target

0bae48116720a1d0564a748068f6bc11.exe
Size

4.4MB
MD5

0bae48116720a1d0564a748068f6bc11
SHA1

8fcf780140f802f6b30071881747b7e5bfd5ed1f
SHA256

6e4ee8588b8409805396726ce7d9bc00f51bfb84fd2dc986b6b68c211edc74fa
SHA512

f7f652bbc556636e4e9d616bfc523258c80d50676a2eb96a440e223990a39452ccde9a0942f79aa156d80067c46dd189f75c894ea0e27b15be6cb486fa3ae745
SSDEEP

98304:W9q+oGJo+qJJL2CXFhmOdc3hKpw0dx4juSWejiXkiOvNqwf7BiqK8XaYtXB:Oq+oGeyUw0wjuSW/XkfNJ74qXD

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
1172	netsh.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4520	2512	WerFault.exe	20

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3924	schtasks.exe

GoLang User-Agent 3 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	87	Go-http-client/1.1
HTTP User-Agent header	88	Go-http-client/1.1
HTTP User-Agent header	89	Go-http-client/1.1

C:\Users\Admin\AppData\Local\Temp\0bae48116720a1d0564a748068f6bc11.exe
"C:\Users\Admin\AppData\Local\Temp\0bae48116720a1d0564a748068f6bc11.exe"
1⤵
PID:2512
- C:\Users\Admin\AppData\Local\Temp\0bae48116720a1d0564a748068f6bc11.exe
  "C:\Users\Admin\AppData\Local\Temp\0bae48116720a1d0564a748068f6bc11.exe"
  2⤵
  PID:2984
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    PID:4468
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:1172
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe ""
    3⤵
    PID:4984
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:3924
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      PID:372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 824
  2⤵
  - Program crash
  PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2512 -ip 2512
1⤵
PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Create or Modify System Process

1

T1543

Windows Service

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
20KB

MD5
2615af781e3738109130da13a8c331f2

SHA1
725672f8156fdc84dbb8ba550d756870a0d63621

SHA256
1700a117063d1786cc964bec826705dcb77beb950943447f7a27e28461575296

SHA512
ac49f8b0bd895807471e92df81d4fcc12f5d4e444237cbdb0e273ca07346045b2384fa8a3886bd83187388f625db8a3a5ea99b92959ef45963d549e12b389df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
26KB

MD5
10c7c3eb45dfb0e4b605eea11aedf3fa

SHA1
16c542938fce4a0373ec4f12bb960de80eab522e

SHA256
62cb875b0ba5d16396db0e8a882b25f4e851d094315c711c8771d91b0d917143

SHA512
4fefd3286fe64111a4a0b9a52d8bbd0b7a9bd1338fd488754cf38024a7b74d7dad7eff15cbd3aa1332feb8f8c70efcba4f385e0847da37c6385fedf59408d5a1

Download Submit
C:\Windows\rss\csrss.exe

Filesize
30KB

MD5
e1856b939f9139d90a6315585fbe4bef

SHA1
4a6cb62a3d5ecdc8a989513ff117738966f60465

SHA256
1c138f417661ae7bc6a9396ac9b2d0950c64a8345d83276f2c69d10c2b011f3e

SHA512
0cd0aa9082a2c52f809d41307b556348487de96da3389de1d9ada5f40f9a5f0e40be86e3fdecc2b61870aba77838a59b1e1f37421304d6b5b737e98b0d9e4636

Download Submit
C:\Windows\rss\csrss.exe

Filesize
53KB

MD5
5ae49f25c5f82cf4e45e8d5ed9d2ba56

SHA1
65ce92de3080227a13da353a0579d696256f77aa

SHA256
08a46d59ce4e3a3b7410b371a3950e6eeea57cdb08dcf8b72518c72f848b959f

SHA512
0acadb5a898f8b296f203799cf1534adad57b2f12a3dedd22b8055bef058d4deaa1303d55478fe2fdfc8804df406ccb9b69fb684de49db99477fe614fa366206

Download Submit
memory/2512-2-0x0000000003B30000-0x0000000004456000-memory.dmp

Filesize
9.1MB

Download
memory/2512-3-0x0000000000400000-0x0000000001844000-memory.dmp

Filesize
20.3MB

Download
memory/2512-5-0x0000000000400000-0x0000000001844000-memory.dmp

Filesize
20.3MB

Download
memory/2512-6-0x0000000003B30000-0x0000000004456000-memory.dmp

Filesize
9.1MB

Download
memory/2512-1-0x00000000036E0000-0x0000000003B2A000-memory.dmp

Filesize
4.3MB

Download
memory/2984-8-0x0000000003910000-0x0000000004236000-memory.dmp

Filesize
9.1MB

Download
memory/2984-16-0x00000000034D0000-0x000000000390E000-memory.dmp

Filesize
4.2MB

Download
memory/2984-21-0x0000000000400000-0x0000000001844000-memory.dmp

Filesize
20.3MB

Download
memory/2984-10-0x0000000000400000-0x0000000001844000-memory.dmp

Filesize
20.3MB

Download
memory/2984-9-0x0000000000400000-0x0000000001844000-memory.dmp

Filesize
20.3MB

Download
memory/2984-7-0x00000000034D0000-0x000000000390E000-memory.dmp

Filesize
4.2MB

Download
memory/4984-24-0x0000000000400000-0x0000000001844000-memory.dmp

Filesize
20.3MB

Download
memory/4984-25-0x0000000000400000-0x0000000001844000-memory.dmp

Filesize
20.3MB

Download
memory/4984-23-0x0000000003A00000-0x0000000003F00000-memory.dmp

Filesize
5.0MB

Download
memory/4984-31-0x0000000000400000-0x0000000001844000-memory.dmp

Filesize
20.3MB

Download
memory/4984-32-0x0000000003A00000-0x0000000003F00000-memory.dmp

Filesize
5.0MB

Download
memory/4984-33-0x0000000000400000-0x0000000001844000-memory.dmp

Filesize
20.3MB

Download
memory/4984-34-0x0000000000400000-0x0000000001844000-memory.dmp

Filesize
20.3MB

Download
memory/4984-35-0x0000000000400000-0x0000000001844000-memory.dmp

Filesize
20.3MB

Download
memory/4984-36-0x0000000000400000-0x0000000001844000-memory.dmp

Filesize
20.3MB

Download
memory/4984-37-0x0000000000400000-0x0000000001844000-memory.dmp

Filesize
20.3MB

Download
memory/4984-38-0x0000000000400000-0x0000000001844000-memory.dmp

Filesize
20.3MB

Download
memory/4984-39-0x0000000000400000-0x0000000001844000-memory.dmp

Filesize
20.3MB

Download
memory/4984-40-0x0000000000400000-0x0000000001844000-memory.dmp

Filesize
20.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads