Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
27/04/2024, 12:17
Static task
static1
Behavioral task
behavioral1
Sample
112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe
Resource
win10v2004-20240419-en
General
-
Target
112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe
-
Size
4.1MB
-
MD5
6987835c461a63dae16bc3f17bae8289
-
SHA1
efa9d995a09403a3e9d4573a40d79bce63da99a4
-
SHA256
112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa
-
SHA512
5f1ea74e0d888e63f224bdf146390c65d2bacc9518b9abd62e7d4760d767b3ce9aa6a2d7355520b1f5ce84461b88b4f81776429faae1f7880168018d9c9295c2
-
SSDEEP
98304:LxCWG3Td/212A9tSPb8vctuIp2ZHNoZVPX5Ut6lNIHcaW+cG6qPFkDdt:LxCr3TdeRtEuctuInVWCNIHlW+Uq6
Malware Config
Signatures
-
Glupteba payload 15 IoCs
resource yara_rule behavioral1/memory/3312-2-0x0000000005070000-0x000000000595B000-memory.dmp family_glupteba behavioral1/memory/3312-3-0x0000000000400000-0x0000000002EDD000-memory.dmp family_glupteba behavioral1/memory/3312-59-0x0000000005070000-0x000000000595B000-memory.dmp family_glupteba behavioral1/memory/3312-57-0x0000000000400000-0x0000000002EDD000-memory.dmp family_glupteba behavioral1/memory/2088-87-0x0000000000400000-0x0000000002EDD000-memory.dmp family_glupteba behavioral1/memory/2088-139-0x0000000000400000-0x0000000002EDD000-memory.dmp family_glupteba behavioral1/memory/1436-165-0x0000000000400000-0x0000000002EDD000-memory.dmp family_glupteba behavioral1/memory/1436-226-0x0000000000400000-0x0000000002EDD000-memory.dmp family_glupteba behavioral1/memory/1436-229-0x0000000000400000-0x0000000002EDD000-memory.dmp family_glupteba behavioral1/memory/1436-232-0x0000000000400000-0x0000000002EDD000-memory.dmp family_glupteba behavioral1/memory/1436-235-0x0000000000400000-0x0000000002EDD000-memory.dmp family_glupteba behavioral1/memory/1436-238-0x0000000000400000-0x0000000002EDD000-memory.dmp family_glupteba behavioral1/memory/1436-241-0x0000000000400000-0x0000000002EDD000-memory.dmp family_glupteba behavioral1/memory/1436-244-0x0000000000400000-0x0000000002EDD000-memory.dmp family_glupteba behavioral1/memory/1436-247-0x0000000000400000-0x0000000002EDD000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 1560 netsh.exe -
Executes dropped EXE 2 IoCs
pid Process 1436 csrss.exe 2108 injector.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\rss 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe File created C:\Windows\rss\csrss.exe 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3256 schtasks.exe 1496 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time" 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3142 = "South Sudan Standard Time" 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time" 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time" 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time" 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time" 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time" 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time" 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time" 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time" 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time" 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time" 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time" 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time" 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2880 powershell.exe 2880 powershell.exe 3312 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe 3312 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe 1004 powershell.exe 1004 powershell.exe 2088 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe 2088 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe 2088 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe 2088 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe 2088 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe 2088 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe 2088 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe 2088 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe 2088 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe 2088 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe 3572 powershell.exe 3572 powershell.exe 784 powershell.exe 784 powershell.exe 2064 powershell.exe 2064 powershell.exe 1252 powershell.exe 1252 powershell.exe 436 powershell.exe 436 powershell.exe 2108 injector.exe 2108 injector.exe 2108 injector.exe 2108 injector.exe 2108 injector.exe 2108 injector.exe 1436 csrss.exe 1436 csrss.exe 2108 injector.exe 2108 injector.exe 2108 injector.exe 2108 injector.exe 2108 injector.exe 2108 injector.exe 1436 csrss.exe 1436 csrss.exe 2108 injector.exe 2108 injector.exe 2108 injector.exe 2108 injector.exe 2108 injector.exe 2108 injector.exe 2108 injector.exe 2108 injector.exe 2108 injector.exe 2108 injector.exe 2108 injector.exe 2108 injector.exe 2108 injector.exe 2108 injector.exe 2108 injector.exe 2108 injector.exe 2108 injector.exe 2108 injector.exe 2108 injector.exe 2108 injector.exe 2108 injector.exe 2108 injector.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 2880 powershell.exe Token: SeDebugPrivilege 3312 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe Token: SeImpersonatePrivilege 3312 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe Token: SeDebugPrivilege 1004 powershell.exe Token: SeDebugPrivilege 3572 powershell.exe Token: SeDebugPrivilege 784 powershell.exe Token: SeDebugPrivilege 2064 powershell.exe Token: SeDebugPrivilege 1252 powershell.exe Token: SeDebugPrivilege 436 powershell.exe Token: SeSystemEnvironmentPrivilege 1436 csrss.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 3312 wrote to memory of 2880 3312 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe 87 PID 3312 wrote to memory of 2880 3312 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe 87 PID 3312 wrote to memory of 2880 3312 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe 87 PID 2088 wrote to memory of 1004 2088 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe 92 PID 2088 wrote to memory of 1004 2088 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe 92 PID 2088 wrote to memory of 1004 2088 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe 92 PID 2088 wrote to memory of 4020 2088 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe 94 PID 2088 wrote to memory of 4020 2088 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe 94 PID 4020 wrote to memory of 1560 4020 cmd.exe 96 PID 4020 wrote to memory of 1560 4020 cmd.exe 96 PID 2088 wrote to memory of 3572 2088 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe 98 PID 2088 wrote to memory of 3572 2088 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe 98 PID 2088 wrote to memory of 3572 2088 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe 98 PID 2088 wrote to memory of 784 2088 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe 100 PID 2088 wrote to memory of 784 2088 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe 100 PID 2088 wrote to memory of 784 2088 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe 100 PID 2088 wrote to memory of 1436 2088 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe 104 PID 2088 wrote to memory of 1436 2088 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe 104 PID 2088 wrote to memory of 1436 2088 112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe 104 PID 1436 wrote to memory of 2064 1436 csrss.exe 107 PID 1436 wrote to memory of 2064 1436 csrss.exe 107 PID 1436 wrote to memory of 2064 1436 csrss.exe 107 PID 1436 wrote to memory of 1252 1436 csrss.exe 115 PID 1436 wrote to memory of 1252 1436 csrss.exe 115 PID 1436 wrote to memory of 1252 1436 csrss.exe 115 PID 1436 wrote to memory of 436 1436 csrss.exe 117 PID 1436 wrote to memory of 436 1436 csrss.exe 117 PID 1436 wrote to memory of 436 1436 csrss.exe 117 PID 1436 wrote to memory of 2108 1436 csrss.exe 119 PID 1436 wrote to memory of 2108 1436 csrss.exe 119 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe"C:\Users\Admin\AppData\Local\Temp\112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2880
-
-
C:\Users\Admin\AppData\Local\Temp\112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe"C:\Users\Admin\AppData\Local\Temp\112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1004
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:1560
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3572
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:784
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2064
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:1496
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:1776
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1252
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:436
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2108
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:3256
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5e7e1d2342688d86fb998cde4e2201733
SHA1be7a0faaad54651a642d6c5717e788b1d48095ca
SHA256f85e10b5670bb5045446250cb7ba09af9fc4a7ef3c578cbc88bce37912125286
SHA5125b42274ed37d7b9c9e2a727cf2055cc5535bec7d5923f5fb9164401c644385e09ffc1aac2f8e2e9d81ded5299e95f826ec95e187241ec039029b5a1bfe29113a
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD57c432b258d7e9163a8ca9619b5e93d2f
SHA1d89b722737a7d9a0679a2f064261e23ed85d1c8e
SHA2560145ec425af9cc8c7c7f2c36e7f714066d43b4ae3939a89e42c45daa156fba71
SHA512acaa6ef164cfbf2f7ae84228fb75815da27d7105baa5f11b4acede9c360a6b7710a0eed58a4120f51b0fb49ca622e92d8f34b8f15cc2293c5bba7cd424f0e439
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD56672b690677e7bd64acf88f855ce2e1c
SHA12a3a778cc2b8e991b2dd23fed7e60367a74c0f00
SHA2566cb13961ce39ef63eb1722092667e6e05eb3d1b4e741060205add3aeb8544369
SHA5127e48fb72f33fe16d492661c0bd1f68f43220ba850c95a2c74c25f5b55d0882fe3161a1e6dbb8a1aa552d128f926eb6ae7c34cb3221590751659a9e85a7d799a2
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5f15a263147faa575fc93bf731796296f
SHA16ae412ff3cc32a3d6ab3593f22ab3173a1749fb7
SHA256dffeb8864e6b25f56b84085bf3069eedca2f95d4ee40208034f70905b18fa61e
SHA5123e64f3fff282a70451c36b735be7b8249e2fdb43650c83487720b1c051058427f602687cb36bc0e47fed64fa53a9795e769464f8d544ad9964f01bd7e4826d4f
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD59d9d703497ff39725041a1f2baf6a9f0
SHA11b053d41f09519f0db6f984a2a78c9a71d5aee27
SHA256ca604d79ea5e9db6fcba284cbf5f91b2722c169e9b5f3d030838bd5c7da9ca17
SHA512f5295a172387787424d3424c87880c920361a03872fc13dde6a53bce3eff77450cc427b760e2ea99b10d6cdaa4a3ab17cc7b1492ba162bc232a44c5b4732e609
-
Filesize
4.1MB
MD56987835c461a63dae16bc3f17bae8289
SHA1efa9d995a09403a3e9d4573a40d79bce63da99a4
SHA256112516b1612a7850cf8136b0ad28613bf5e46acb4e84c3467397d5f1635babaa
SHA5125f1ea74e0d888e63f224bdf146390c65d2bacc9518b9abd62e7d4760d767b3ce9aa6a2d7355520b1f5ce84461b88b4f81776429faae1f7880168018d9c9295c2