b50cb54a9ab60b6f15fa1dc80839aa5b7ed29df905302b0e512e6636c78d44b9

General

Target

63652f9292efd244acba57450c992226.exe
Size

390KB
MD5

63652f9292efd244acba57450c992226
SHA1

1741cd019a07a0d3c2320cddabf9f0d647b49ab5
SHA256

b50cb54a9ab60b6f15fa1dc80839aa5b7ed29df905302b0e512e6636c78d44b9
SHA512

258e3f794a50d251b5050b447f75db1559a64bae9f5fe8b9fa35ed0b15e99fd459263d7c46b70d68f7b53bcbd38998e7d39086d43c4cfe559d051e5854c335e2
SSDEEP

6144:9yy/QuYdv1NYBwKRlWuBX5gOuCMZaxaw6hQn8ZlMKHBEbXNLwP1NVO0C:9ySYCzJgOeZQCsYrEDRYjO0C

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2420	cssrs.exe

Loads dropped DLL 2 IoCs

pid	Process
2868	63652f9292efd244acba57450c992226.exe
2868	63652f9292efd244acba57450c992226.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2868-0-0x0000000000400000-0x00000000004D2000-memory.dmp	upx
behavioral1/files/0x000a000000013a1a-3.dat	upx
behavioral1/files/0x000a000000013a1a-9.dat	upx
behavioral1/files/0x000a000000013a1a-11.dat	upx
behavioral1/memory/2868-5-0x0000000001ED0000-0x0000000001FA2000-memory.dmp	upx
behavioral1/memory/2420-12-0x0000000000400000-0x00000000004D2000-memory.dmp	upx
behavioral1/memory/2868-14-0x0000000000400000-0x00000000004D2000-memory.dmp	upx
behavioral1/memory/2868-15-0x0000000000400000-0x00000000004D2000-memory.dmp	upx
behavioral1/memory/2420-16-0x0000000000400000-0x00000000004D2000-memory.dmp	upx
behavioral1/memory/2420-17-0x0000000000400000-0x00000000004D2000-memory.dmp	upx
behavioral1/memory/2420-18-0x0000000000400000-0x00000000004D2000-memory.dmp	upx
behavioral1/memory/2420-20-0x0000000000400000-0x00000000004D2000-memory.dmp	upx
behavioral1/memory/2420-21-0x0000000000400000-0x00000000004D2000-memory.dmp	upx
behavioral1/memory/2420-22-0x0000000000400000-0x00000000004D2000-memory.dmp	upx
behavioral1/memory/2420-24-0x0000000000400000-0x00000000004D2000-memory.dmp	upx
behavioral1/memory/2420-25-0x0000000000400000-0x00000000004D2000-memory.dmp	upx
behavioral1/memory/2420-26-0x0000000000400000-0x00000000004D2000-memory.dmp	upx
behavioral1/memory/2420-27-0x0000000000400000-0x00000000004D2000-memory.dmp	upx
behavioral1/memory/2420-28-0x0000000000400000-0x00000000004D2000-memory.dmp	upx
behavioral1/memory/2420-29-0x0000000000400000-0x00000000004D2000-memory.dmp	upx
behavioral1/memory/2420-31-0x0000000000400000-0x00000000004D2000-memory.dmp	upx
behavioral1/memory/2420-32-0x0000000000400000-0x00000000004D2000-memory.dmp	upx
behavioral1/memory/2420-33-0x0000000000400000-0x00000000004D2000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Run\JavaUpdatecda9 = "c:\\systeam\\reaction\\cssrs.exe"	reg.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
2384	taskkill.exe
2216	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2384	taskkill.exe
Token: SeDebugPrivilege	2216	taskkill.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2384	2868	63652f9292efd244acba57450c992226.exe	28
PID 2868 wrote to memory of 2384	2868	63652f9292efd244acba57450c992226.exe	28
PID 2868 wrote to memory of 2384	2868	63652f9292efd244acba57450c992226.exe	28
PID 2868 wrote to memory of 2384	2868	63652f9292efd244acba57450c992226.exe	28
PID 2868 wrote to memory of 2216	2868	63652f9292efd244acba57450c992226.exe	29
PID 2868 wrote to memory of 2216	2868	63652f9292efd244acba57450c992226.exe	29
PID 2868 wrote to memory of 2216	2868	63652f9292efd244acba57450c992226.exe	29
PID 2868 wrote to memory of 2216	2868	63652f9292efd244acba57450c992226.exe	29
PID 2868 wrote to memory of 2420	2868	63652f9292efd244acba57450c992226.exe	33
PID 2868 wrote to memory of 2420	2868	63652f9292efd244acba57450c992226.exe	33
PID 2868 wrote to memory of 2420	2868	63652f9292efd244acba57450c992226.exe	33
PID 2868 wrote to memory of 2420	2868	63652f9292efd244acba57450c992226.exe	33
PID 2420 wrote to memory of 2764	2420	cssrs.exe	35
PID 2420 wrote to memory of 2764	2420	cssrs.exe	35
PID 2420 wrote to memory of 2764	2420	cssrs.exe	35
PID 2420 wrote to memory of 2764	2420	cssrs.exe	35

C:\Users\Admin\AppData\Local\Temp\63652f9292efd244acba57450c992226.exe
"C:\Users\Admin\AppData\Local\Temp\63652f9292efd244acba57450c992226.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\taskkill.exe
  taskkill -f /im cssrs.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2384
- C:\Windows\SysWOW64\taskkill.exe
  taskkill -f /im cssrs.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2216
- \??\c:\systeam\reaction\cssrs.exe
  c:\systeam\reaction\cssrs.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v JavaUpdatecda9 /d "c:\systeam\reaction\cssrs.exe" /f
    3⤵
    - Adds Run key to start application
    PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\systeam\reaction\cssrs.exe

Filesize
249KB

MD5
979e356a545a96f0bd5ec25e3e0502b2

SHA1
7f6ca10070b4d96b3b23042d42d17a9765115982

SHA256
8ee99a812f6e36ceca25b1f978e88ca4b03230f1b3df80034158e4d56065786d

SHA512
1d79ef09e31b2c496be92c7bc98f9af270e90b7d7893fafd14aad36fdd222aebb5a8ee918f281f0fa6e42dea0d3bfaf839aaf017f706e78bf2baf2f01270e6bd

Download Submit
C:\systeam\reaction\cssrs.exe

Filesize
358KB

MD5
e662a4f69f9917b505091a9ce5eeab3a

SHA1
f6886fedc6b1bb78874594feebd511abcaf3b066

SHA256
c5c031f85d08bdbbd0dda9ffb458e10819f060e49f29cbc4c4407a877871993f

SHA512
acec3d8217c5a7ace8acdcc0059d5030e31f8d817029338829fa0dcacef99424df918a6edc6f8b0ea2b2635c85595feb002b85d6f6323d29a8929bcf128a81de

Download Submit
\systeam\reaction\cssrs.exe

Filesize
390KB

MD5
63652f9292efd244acba57450c992226

SHA1
1741cd019a07a0d3c2320cddabf9f0d647b49ab5

SHA256
b50cb54a9ab60b6f15fa1dc80839aa5b7ed29df905302b0e512e6636c78d44b9

SHA512
258e3f794a50d251b5050b447f75db1559a64bae9f5fe8b9fa35ed0b15e99fd459263d7c46b70d68f7b53bcbd38998e7d39086d43c4cfe559d051e5854c335e2

Download Submit
memory/2420-24-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/2420-25-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/2420-33-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/2420-32-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/2420-13-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2420-12-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/2420-31-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/2420-29-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/2420-16-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/2420-17-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/2420-18-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/2420-19-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2420-20-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/2420-21-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/2420-22-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/2420-28-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/2420-27-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/2420-26-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/2868-1-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/2868-0-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/2868-15-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/2868-14-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/2868-5-0x0000000001ED0000-0x0000000001FA2000-memory.dmp

Filesize
840KB

Download
memory/2868-10-0x0000000001ED0000-0x0000000001FA2000-memory.dmp

Filesize
840KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads