a9f1c80bae5107f0cae797b03a7dc52df7b7bb852f0ab3ffd9281c8b7b23e2a4

General

Target

4fecc9e93adda068a35ae69b127d5ea2.exe
Size

211KB
MD5

4fecc9e93adda068a35ae69b127d5ea2
SHA1

cfeb8f8a31566d8eb4fe7aa6087cf66ba4f663c8
SHA256

a9f1c80bae5107f0cae797b03a7dc52df7b7bb852f0ab3ffd9281c8b7b23e2a4
SHA512

e9af103c777c5eddf9c9576d3ca64a5f012941e59c820dac68e449945c48e1450e7faa5d040f9fddffe03d13e3fa8241694d1f48dc6c4280a585d398b9b4bd34
SSDEEP

6144:HoL9izSBzlQeNSNXTxv17Mcb+DlAOgwaj8B8L8HVNblJlPHsaz5i7nSngy9vImwQ:kzgNF97McSDlsgg81VlJlPZi7nSngy99

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2752	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
336	csrss.exe

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64
Destination IP	94.242.250.64

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1060 set thread context of 2752	1060	4fecc9e93adda068a35ae69b127d5ea2.exe	28

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1060	4fecc9e93adda068a35ae69b127d5ea2.exe
1060	4fecc9e93adda068a35ae69b127d5ea2.exe
1060	4fecc9e93adda068a35ae69b127d5ea2.exe
1060	4fecc9e93adda068a35ae69b127d5ea2.exe
336	csrss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1060	4fecc9e93adda068a35ae69b127d5ea2.exe
Token: SeDebugPrivilege	1060	4fecc9e93adda068a35ae69b127d5ea2.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
336	csrss.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 1264	1060	4fecc9e93adda068a35ae69b127d5ea2.exe	18
PID 1060 wrote to memory of 336	1060	4fecc9e93adda068a35ae69b127d5ea2.exe	6
PID 1060 wrote to memory of 2752	1060	4fecc9e93adda068a35ae69b127d5ea2.exe	28
PID 1060 wrote to memory of 2752	1060	4fecc9e93adda068a35ae69b127d5ea2.exe	28
PID 1060 wrote to memory of 2752	1060	4fecc9e93adda068a35ae69b127d5ea2.exe	28
PID 1060 wrote to memory of 2752	1060	4fecc9e93adda068a35ae69b127d5ea2.exe	28
PID 1060 wrote to memory of 2752	1060	4fecc9e93adda068a35ae69b127d5ea2.exe	28
PID 336 wrote to memory of 2768	336	csrss.exe	30
PID 336 wrote to memory of 2768	336	csrss.exe	30
PID 336 wrote to memory of 2640	336	csrss.exe	31
PID 336 wrote to memory of 2640	336	csrss.exe	31
PID 336 wrote to memory of 848	336	csrss.exe	10

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:848
- C:\Windows\system32\wbem\WMIADAP.EXE
  wmiadap.exe /F /T /R
  2⤵
  PID:2768

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1264
- C:\Users\Admin\AppData\Local\Temp\4fecc9e93adda068a35ae69b127d5ea2.exe
  "C:\Users\Admin\AppData\Local\Temp\4fecc9e93adda068a35ae69b127d5ea2.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:2752

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:2640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32\consrv.dll

Filesize
52KB

MD5
6bf2039986af96d98e08824ac6c383fd

SHA1
0bb6384656a96943cb427baa92446f987219a02e

SHA256
a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

SHA512
fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

Download Submit
\??\globalroot\systemroot\assembly\temp\@

Filesize
2KB

MD5
1444b4974642b657076f69f4e844a7cc

SHA1
801bc35bb793c7e55bf2546cc9b195e141288c33

SHA256
70d84ede5444da3b5f79421e415e1328baa9b85ebf8d9155cfd257a83d33b240

SHA512
990eef5f0cdc63c67ab07e0f1115093f658f4a4f2bd73893b1b256682b77db60d36b445a4c664029d3bd4302b5d92b0b31a87f0e0c9f2fc3e97b5da7e5ec4b31

Download Submit
memory/336-19-0x00000000026B0000-0x00000000026B2000-memory.dmp

Filesize
8KB

Download
memory/336-18-0x0000000002170000-0x0000000002181000-memory.dmp

Filesize
68KB

Download
memory/336-27-0x00000000026B0000-0x00000000026B2000-memory.dmp

Filesize
8KB

Download
memory/336-20-0x0000000002170000-0x0000000002181000-memory.dmp

Filesize
68KB

Download
memory/336-28-0x0000000002170000-0x0000000002181000-memory.dmp

Filesize
68KB

Download
memory/848-30-0x0000000000270000-0x000000000027B000-memory.dmp

Filesize
44KB

Download
memory/848-38-0x0000000000270000-0x000000000027B000-memory.dmp

Filesize
44KB

Download
memory/848-39-0x0000000000260000-0x0000000000268000-memory.dmp

Filesize
32KB

Download
memory/848-43-0x0000000000260000-0x0000000000268000-memory.dmp

Filesize
32KB

Download
memory/848-44-0x0000000000280000-0x000000000028B000-memory.dmp

Filesize
44KB

Download
memory/848-40-0x0000000000280000-0x000000000028B000-memory.dmp

Filesize
44KB

Download
memory/848-34-0x0000000000270000-0x000000000027B000-memory.dmp

Filesize
44KB

Download
memory/1060-25-0x00000000001B0000-0x00000000001E6000-memory.dmp

Filesize
216KB

Download
memory/1060-26-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1060-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1060-23-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1060-2-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1060-1-0x00000000001B0000-0x00000000001E6000-memory.dmp

Filesize
216KB

Download
memory/1264-12-0x00000000026B0000-0x00000000026B2000-memory.dmp

Filesize
8KB

Download
memory/1264-3-0x00000000026C0000-0x00000000026C6000-memory.dmp

Filesize
24KB

Download
memory/1264-7-0x00000000026C0000-0x00000000026C6000-memory.dmp

Filesize
24KB

Download
memory/1264-11-0x00000000026C0000-0x00000000026C6000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing