b0472eee801b88dba9c805cd4dc928590c88c85933bb6f780cb64b41b79617a2

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/03/2024, 14:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

de35b932b01a7ac7253c073dcf7fe0e9.exe
Size

149KB
MD5

de35b932b01a7ac7253c073dcf7fe0e9
SHA1

a2c8eb7dfa138e1f11fd7f1cadc2945603c925c7
SHA256

b0472eee801b88dba9c805cd4dc928590c88c85933bb6f780cb64b41b79617a2
SHA512

c9eb8f4c4c5a3379026a7caea9d5a2b73b272613b653c26ecf5adf4c840a5b9e31b075c1ab11178e5c5de4c66287121bd46df5299f2c396087198785c4ee8b9c
SSDEEP

3072:wGQJL20ZG009teM8XnZQLpgwWyM22/z/g21rfeEr+W7REQVa:wlV1E08AELpRWwW/5Xp7WQVa

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2104	cmd.exe

Executes dropped EXE 4 IoCs

pid	Process
2652	csrs.exe
2248	csrs.exe
608	iexplore.exe
336	iexplore.exe

Loads dropped DLL 6 IoCs

pid	Process
2588	de35b932b01a7ac7253c073dcf7fe0e9.exe
2588	de35b932b01a7ac7253c073dcf7fe0e9.exe
2652	csrs.exe
2248	csrs.exe
2248	csrs.exe
608	iexplore.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\csrs.exe	de35b932b01a7ac7253c073dcf7fe0e9.exe
File opened for modification	C:\Windows\SysWOW64\csrs.exe	de35b932b01a7ac7253c073dcf7fe0e9.exe
File created	C:\Windows\SysWOW64\iexplore.exe	csrs.exe
File opened for modification	C:\Windows\SysWOW64\iexplore.exe	csrs.exe
File created	C:\Windows\SysWOW64\devhb.bat	csrs.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3044 set thread context of 2588	3044	de35b932b01a7ac7253c073dcf7fe0e9.exe	28
PID 2652 set thread context of 2248	2652	csrs.exe	32
PID 608 set thread context of 336	608	iexplore.exe	36

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3044	de35b932b01a7ac7253c073dcf7fe0e9.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3044	de35b932b01a7ac7253c073dcf7fe0e9.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
336	iexplore.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2588	3044	de35b932b01a7ac7253c073dcf7fe0e9.exe	28
PID 3044 wrote to memory of 2588	3044	de35b932b01a7ac7253c073dcf7fe0e9.exe	28
PID 3044 wrote to memory of 2588	3044	de35b932b01a7ac7253c073dcf7fe0e9.exe	28
PID 3044 wrote to memory of 2588	3044	de35b932b01a7ac7253c073dcf7fe0e9.exe	28
PID 3044 wrote to memory of 2588	3044	de35b932b01a7ac7253c073dcf7fe0e9.exe	28
PID 3044 wrote to memory of 2588	3044	de35b932b01a7ac7253c073dcf7fe0e9.exe	28
PID 3044 wrote to memory of 2588	3044	de35b932b01a7ac7253c073dcf7fe0e9.exe	28
PID 3044 wrote to memory of 2588	3044	de35b932b01a7ac7253c073dcf7fe0e9.exe	28
PID 3044 wrote to memory of 2588	3044	de35b932b01a7ac7253c073dcf7fe0e9.exe	28
PID 2588 wrote to memory of 2104	2588	de35b932b01a7ac7253c073dcf7fe0e9.exe	29
PID 2588 wrote to memory of 2104	2588	de35b932b01a7ac7253c073dcf7fe0e9.exe	29
PID 2588 wrote to memory of 2104	2588	de35b932b01a7ac7253c073dcf7fe0e9.exe	29
PID 2588 wrote to memory of 2104	2588	de35b932b01a7ac7253c073dcf7fe0e9.exe	29
PID 2588 wrote to memory of 2652	2588	de35b932b01a7ac7253c073dcf7fe0e9.exe	31
PID 2588 wrote to memory of 2652	2588	de35b932b01a7ac7253c073dcf7fe0e9.exe	31
PID 2588 wrote to memory of 2652	2588	de35b932b01a7ac7253c073dcf7fe0e9.exe	31
PID 2588 wrote to memory of 2652	2588	de35b932b01a7ac7253c073dcf7fe0e9.exe	31
PID 2652 wrote to memory of 2248	2652	csrs.exe	32
PID 2652 wrote to memory of 2248	2652	csrs.exe	32
PID 2652 wrote to memory of 2248	2652	csrs.exe	32
PID 2652 wrote to memory of 2248	2652	csrs.exe	32
PID 2652 wrote to memory of 2248	2652	csrs.exe	32
PID 2652 wrote to memory of 2248	2652	csrs.exe	32
PID 2652 wrote to memory of 2248	2652	csrs.exe	32
PID 2652 wrote to memory of 2248	2652	csrs.exe	32
PID 2652 wrote to memory of 2248	2652	csrs.exe	32
PID 2248 wrote to memory of 2856	2248	csrs.exe	33
PID 2248 wrote to memory of 2856	2248	csrs.exe	33
PID 2248 wrote to memory of 2856	2248	csrs.exe	33
PID 2248 wrote to memory of 2856	2248	csrs.exe	33
PID 2248 wrote to memory of 608	2248	csrs.exe	35
PID 2248 wrote to memory of 608	2248	csrs.exe	35
PID 2248 wrote to memory of 608	2248	csrs.exe	35
PID 2248 wrote to memory of 608	2248	csrs.exe	35
PID 608 wrote to memory of 336	608	iexplore.exe	36
PID 608 wrote to memory of 336	608	iexplore.exe	36
PID 608 wrote to memory of 336	608	iexplore.exe	36
PID 608 wrote to memory of 336	608	iexplore.exe	36
PID 608 wrote to memory of 336	608	iexplore.exe	36
PID 608 wrote to memory of 336	608	iexplore.exe	36
PID 608 wrote to memory of 336	608	iexplore.exe	36
PID 608 wrote to memory of 336	608	iexplore.exe	36
PID 608 wrote to memory of 336	608	iexplore.exe	36

C:\Users\Admin\AppData\Local\Temp\de35b932b01a7ac7253c073dcf7fe0e9.exe
"C:\Users\Admin\AppData\Local\Temp\de35b932b01a7ac7253c073dcf7fe0e9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Users\Admin\AppData\Local\Temp\de35b932b01a7ac7253c073dcf7fe0e9.exe
  "C:\Users\Admin\AppData\Local\Temp\de35b932b01a7ac7253c073dcf7fe0e9.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\xfjjo.bat" "
    3⤵
    - Deletes itself
    PID:2104
- - C:\Windows\SysWOW64\csrs.exe
    C:\Windows\system32\csrs.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\Windows\SysWOW64\csrs.exe
      "C:\Windows\SysWOW64\csrs.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2248
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Windows\SysWOW64\devhb.bat" "
        5⤵
        
        PID:2856
    - - C:\Windows\SysWOW64\iexplore.exe
        
        C:\Windows\system32\iexplore.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:608
      - C:\Windows\SysWOW64\iexplore.exe
        
        "C:\Windows\SysWOW64\iexplore.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of UnmapMainImage
        
        PID:336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\xfjjo.bat

Filesize
199B

MD5
b9bba498ac824b56567e31b5f2a48bb5

SHA1
66328ee14fb4b237bdd96f01b589c78b1aacf6f8

SHA256
a7f64bfce3b6602a7c0d366371f86128576081a11bd54dbc09aaa7365eb17571

SHA512
dcb48f6deccbb1ae3db8cdb2161a8b970b86c991546e591c7ee6f8db1e097710eeb01780903d314a2ae4c3910c4e6e5bd51daa55502ac3bf0bdd143d2440fab9

Download Submit
C:\Windows\SysWOW64\csrs.exe

Filesize
149KB

MD5
de35b932b01a7ac7253c073dcf7fe0e9

SHA1
a2c8eb7dfa138e1f11fd7f1cadc2945603c925c7

SHA256
b0472eee801b88dba9c805cd4dc928590c88c85933bb6f780cb64b41b79617a2

SHA512
c9eb8f4c4c5a3379026a7caea9d5a2b73b272613b653c26ecf5adf4c840a5b9e31b075c1ab11178e5c5de4c66287121bd46df5299f2c396087198785c4ee8b9c

Download Submit
C:\Windows\SysWOW64\devhb.bat

Filesize
115B

MD5
683bd8a034ab7b5841f265b342d202e4

SHA1
671c5e5bcefd23f81689f6cf7718fa5608092b8c

SHA256
ea8870f605c40e82dadaddd3fc995988bba51e2afeed1fb785d9288faa641ce3

SHA512
f696365ae7786e996138e16b45d4ba7517a418e7b78ca387a4667d4c0c029ad6b11ab53a83bf3393c2dd22fefb6c53aeeb433f1a7317b8f76f03b6f454948976

Download Submit
memory/336-89-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/608-97-0x0000000000010000-0x0000000000047000-memory.dmp

Filesize
220KB

Download
memory/608-96-0x00000000003F0000-0x0000000000457000-memory.dmp

Filesize
412KB

Download
memory/2248-74-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2588-14-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2588-37-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2588-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2588-10-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2588-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2588-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2588-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2588-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2652-94-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3044-93-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download