cfe2877082e3d9c785b69a55e5c73ec1c6d248915997a14042f712acf10953b5

General

Target

29d28fe2b592d29fba6fe17ac6c70a54.exe
Size

184KB
MD5

29d28fe2b592d29fba6fe17ac6c70a54
SHA1

e4dfd9c874a9949734a29b40a15eef95bb8459ba
SHA256

cfe2877082e3d9c785b69a55e5c73ec1c6d248915997a14042f712acf10953b5
SHA512

ea5e3c9d0d0f0f78bf4e487e2a6e71e026a9091b0723e1e4ab8e08f7f3568231fd54d73864925c3874bd212b66bae4e6b0642195b58eaa68c569a8fd82a15e0c
SSDEEP

3072:UrV+TTp/Yq6JA45c/UULBhxSn+O5qvVn+Vp9cNecN5pEkXqSbo4nvSMgHOaISSkI:gVS/5458xLEn+vAVpoXRqSbokvSMgo/1

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2836	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
336	csrss.exe

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3048 set thread context of 2836	3048	29d28fe2b592d29fba6fe17ac6c70a54.exe	30

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3048	29d28fe2b592d29fba6fe17ac6c70a54.exe
3048	29d28fe2b592d29fba6fe17ac6c70a54.exe
3048	29d28fe2b592d29fba6fe17ac6c70a54.exe
3048	29d28fe2b592d29fba6fe17ac6c70a54.exe
336	csrss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3048	29d28fe2b592d29fba6fe17ac6c70a54.exe
Token: SeDebugPrivilege	3048	29d28fe2b592d29fba6fe17ac6c70a54.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
336	csrss.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 1272	3048	29d28fe2b592d29fba6fe17ac6c70a54.exe	21
PID 3048 wrote to memory of 336	3048	29d28fe2b592d29fba6fe17ac6c70a54.exe	6
PID 336 wrote to memory of 2816	336	csrss.exe	28
PID 336 wrote to memory of 2816	336	csrss.exe	28
PID 336 wrote to memory of 2844	336	csrss.exe	29
PID 336 wrote to memory of 2844	336	csrss.exe	29
PID 3048 wrote to memory of 2836	3048	29d28fe2b592d29fba6fe17ac6c70a54.exe	30
PID 3048 wrote to memory of 2836	3048	29d28fe2b592d29fba6fe17ac6c70a54.exe	30
PID 3048 wrote to memory of 2836	3048	29d28fe2b592d29fba6fe17ac6c70a54.exe	30
PID 3048 wrote to memory of 2836	3048	29d28fe2b592d29fba6fe17ac6c70a54.exe	30
PID 3048 wrote to memory of 2836	3048	29d28fe2b592d29fba6fe17ac6c70a54.exe	30
PID 336 wrote to memory of 852	336	csrss.exe	9

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:852
- C:\Windows\system32\wbem\WMIADAP.EXE
  wmiadap.exe /F /T /R
  2⤵
  PID:2816

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1272
- C:\Users\Admin\AppData\Local\Temp\29d28fe2b592d29fba6fe17ac6c70a54.exe
  "C:\Users\Admin\AppData\Local\Temp\29d28fe2b592d29fba6fe17ac6c70a54.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:2836

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:2844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\??\globalroot\systemroot\assembly\temp\@

Filesize
2KB

MD5
a4f5cd284587d36d6fd32df783855e98

SHA1
33241ecd844899242bdb16956dbda58be7ead300

SHA256
82334fddcafd7a9f240cf1fd7fc7358590644c68e2fd69d1f3e0ed74a991bc6c

SHA512
ff7bee507a1875afecff2296dbcfcc1203c0e23dfea962be8b8d57b4a1bf2bda58c5596ec5f4cc824ee8df7d7ff07449697707958a2af71228446cd401179dca

Download Submit
\Windows\System32\consrv.dll

Filesize
52KB

MD5
6bf2039986af96d98e08824ac6c383fd

SHA1
0bb6384656a96943cb427baa92446f987219a02e

SHA256
a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

SHA512
fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

Download Submit
memory/336-30-0x0000000000830000-0x0000000000841000-memory.dmp

Filesize
68KB

Download
memory/336-29-0x0000000000730000-0x0000000000731000-memory.dmp

Filesize
4KB

Download
memory/336-22-0x0000000000830000-0x0000000000841000-memory.dmp

Filesize
68KB

Download
memory/336-21-0x0000000000830000-0x0000000000841000-memory.dmp

Filesize
68KB

Download
memory/336-20-0x0000000000730000-0x0000000000731000-memory.dmp

Filesize
4KB

Download
memory/852-32-0x0000000000940000-0x000000000094B000-memory.dmp

Filesize
44KB

Download
memory/852-37-0x0000000000940000-0x000000000094B000-memory.dmp

Filesize
44KB

Download
memory/852-45-0x0000000000950000-0x000000000095B000-memory.dmp

Filesize
44KB

Download
memory/852-44-0x0000000000950000-0x000000000095B000-memory.dmp

Filesize
44KB

Download
memory/852-42-0x0000000000950000-0x000000000095B000-memory.dmp

Filesize
44KB

Download
memory/852-41-0x0000000000940000-0x000000000094B000-memory.dmp

Filesize
44KB

Download
memory/852-33-0x0000000000930000-0x0000000000938000-memory.dmp

Filesize
32KB

Download
memory/1272-10-0x0000000002B20000-0x0000000002B26000-memory.dmp

Filesize
24KB

Download
memory/1272-6-0x0000000001DB0000-0x0000000001DB2000-memory.dmp

Filesize
8KB

Download
memory/1272-5-0x0000000002B20000-0x0000000002B26000-memory.dmp

Filesize
24KB

Download
memory/1272-14-0x0000000002B20000-0x0000000002B26000-memory.dmp

Filesize
24KB

Download
memory/3048-4-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3048-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3048-2-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3048-3-0x0000000000220000-0x000000000025F000-memory.dmp

Filesize
252KB

Download
memory/3048-28-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3048-1-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3048-27-0x0000000000220000-0x000000000025F000-memory.dmp

Filesize
252KB

Download
memory/3048-25-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing