6a143bdb72a0772f0eb4491527eb7bd0a64014cbec80a187d2403ae086ca1aeb

General

Target

0ff5f0d883441bf08eedcb54a86a977d.exe
Size

212KB
MD5

0ff5f0d883441bf08eedcb54a86a977d
SHA1

fcbb4c59a9f3a8c82348ea0c5bfccf407c796ed0
SHA256

6a143bdb72a0772f0eb4491527eb7bd0a64014cbec80a187d2403ae086ca1aeb
SHA512

3bd09f8d521c604a2de5aca1fadda6e67a801277a3848a66265635e00d2d643cfa3e629fceeff1c2eaa82f85ea971b8902050030b37555c5a6fbe1fc1e16b471
SSDEEP

3072:fgJjL2a62L6xuddxi9snRGt2hkRZM0MViEUbgM6r5lXgMBCqN83VfbuXUH1Ng+aL:fH2exuUsRxkPSTrPgM0c83vH1Ng

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2628	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
340	csrss.exe

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1960 set thread context of 2628	1960	0ff5f0d883441bf08eedcb54a86a977d.exe	28

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1960	0ff5f0d883441bf08eedcb54a86a977d.exe
1960	0ff5f0d883441bf08eedcb54a86a977d.exe
1960	0ff5f0d883441bf08eedcb54a86a977d.exe
1960	0ff5f0d883441bf08eedcb54a86a977d.exe
340	csrss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1960	0ff5f0d883441bf08eedcb54a86a977d.exe
Token: SeDebugPrivilege	1960	0ff5f0d883441bf08eedcb54a86a977d.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
340	csrss.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1168	1960	0ff5f0d883441bf08eedcb54a86a977d.exe	7
PID 1960 wrote to memory of 340	1960	0ff5f0d883441bf08eedcb54a86a977d.exe	26
PID 1960 wrote to memory of 2628	1960	0ff5f0d883441bf08eedcb54a86a977d.exe	28
PID 1960 wrote to memory of 2628	1960	0ff5f0d883441bf08eedcb54a86a977d.exe	28
PID 1960 wrote to memory of 2628	1960	0ff5f0d883441bf08eedcb54a86a977d.exe	28
PID 1960 wrote to memory of 2628	1960	0ff5f0d883441bf08eedcb54a86a977d.exe	28
PID 1960 wrote to memory of 2628	1960	0ff5f0d883441bf08eedcb54a86a977d.exe	28
PID 340 wrote to memory of 1064	340	csrss.exe	30
PID 340 wrote to memory of 1064	340	csrss.exe	30
PID 340 wrote to memory of 2660	340	csrss.exe	31
PID 340 wrote to memory of 2660	340	csrss.exe	31
PID 340 wrote to memory of 872	340	csrss.exe	15

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1168
- C:\Users\Admin\AppData\Local\Temp\0ff5f0d883441bf08eedcb54a86a977d.exe
  "C:\Users\Admin\AppData\Local\Temp\0ff5f0d883441bf08eedcb54a86a977d.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:2628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:872
- C:\Windows\system32\wbem\WMIADAP.EXE
  wmiadap.exe /F /T /R
  2⤵
  PID:1064

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:340

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:2660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32\consrv.dll

Filesize
52KB

MD5
6bf2039986af96d98e08824ac6c383fd

SHA1
0bb6384656a96943cb427baa92446f987219a02e

SHA256
a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

SHA512
fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

Download Submit
\??\globalroot\systemroot\assembly\temp\@

Filesize
2KB

MD5
17a36e1f93420ebe32e15c48e14e75e3

SHA1
f2c34fd35ebd9f916f00feaa58f85bcb51059607

SHA256
c27904bf910bf0a1f9efa259502ea81125a82f741f0b188c0cfeec0882ec87a6

SHA512
90b3317978eb8e5850979ef686d08a90925eb2696eddd9ed8a6908e64a8aa080d2e0ed8499654cefc156f4c2d981fd64960ebb3ba800bac9a99d25c413761fe9

Download Submit
memory/340-29-0x0000000000E40000-0x0000000000E51000-memory.dmp

Filesize
68KB

Download
memory/340-28-0x0000000002F00000-0x0000000002F02000-memory.dmp

Filesize
8KB

Download
memory/340-22-0x0000000000E40000-0x0000000000E51000-memory.dmp

Filesize
68KB

Download
memory/340-21-0x0000000000E40000-0x0000000000E51000-memory.dmp

Filesize
68KB

Download
memory/872-43-0x0000000000BE0000-0x0000000000BEB000-memory.dmp

Filesize
44KB

Download
memory/872-31-0x0000000000BD0000-0x0000000000BDB000-memory.dmp

Filesize
44KB

Download
memory/872-44-0x0000000000BE0000-0x0000000000BEB000-memory.dmp

Filesize
44KB

Download
memory/872-32-0x0000000000310000-0x0000000000318000-memory.dmp

Filesize
32KB

Download
memory/872-36-0x0000000000BD0000-0x0000000000BDB000-memory.dmp

Filesize
44KB

Download
memory/872-40-0x0000000000BD0000-0x0000000000BDB000-memory.dmp

Filesize
44KB

Download
memory/872-41-0x0000000000BE0000-0x0000000000BEB000-memory.dmp

Filesize
44KB

Download
memory/1168-6-0x0000000002F10000-0x0000000002F16000-memory.dmp

Filesize
24KB

Download
memory/1168-15-0x0000000002F00000-0x0000000002F02000-memory.dmp

Filesize
8KB

Download
memory/1168-14-0x0000000002F10000-0x0000000002F16000-memory.dmp

Filesize
24KB

Download
memory/1168-10-0x0000000002F10000-0x0000000002F16000-memory.dmp

Filesize
24KB

Download
memory/1960-3-0x00000000002F0000-0x0000000000347000-memory.dmp

Filesize
348KB

Download
memory/1960-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1960-1-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1960-2-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1960-27-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1960-25-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1960-4-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1960-5-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download

Analysis

Sharing