Static task
static1
General
-
Target
csrss.exe
-
Size
300.4MB
-
MD5
3b8cc0be536ce3af083852089f3f668f
-
SHA1
a858dc0ee6fc8f6026a186c637331fded22e56a7
-
SHA256
d2c04698e0f237d4d66fc4e6be0c4b8f6c8fd156f237352e0d30f4b72474b714
-
SHA512
27f758f026b1cb4e475d1e1fc32abccd753eb375e07bfc4c54287ecf84792a7997ee6b90d372260fe8ab52e8813e82023e48f03440cce3a7a06a05e3e30b2815
-
SSDEEP
12288:kmRuu+l5X3XK709xYnN862P98FJn5vQM:ko+l5X3XK03YN8HkwM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource csrss.exe
Files
-
csrss.exe.exe windows:5 windows x86 arch:x86
511795205251937189f1413f04853250
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LocalUnlock
PulseEvent
GetConsoleAliasesLengthW
GetProcessIoCounters
WriteConsoleOutputCharacterA
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
InterlockedDecrement
CreateDirectoryW
CreateNamedPipeW
GetLocaleInfoW
FatalAppExitW
SetConsoleCP
HeapCreate
ReplaceFileA
GetConsoleAliasesW
GetStdHandle
GetComputerNameA
SetLastError
CreateTimerQueueTimer
SetStdHandle
PrepareTape
LoadLibraryA
LocalAlloc
AddAtomA
DebugSetProcessKillOnExit
lstrcatW
VirtualProtect
EnumDateFormatsW
GetFileTime
SetFileAttributesW
GetVolumeInformationW
WriteConsoleW
CloseHandle
SetFilePointer
GetCurrentDirectoryW
GetSystemDefaultLangID
FlushFileBuffers
GetConsoleMode
HeapAlloc
EncodePointer
DecodePointer
GetCommandLineW
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetProcAddress
GetModuleHandleW
ExitProcess
WriteFile
GetModuleFileNameW
Sleep
HeapSize
EnterCriticalSection
LeaveCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
GetLastError
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RaiseException
LoadLibraryW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
RtlUnwind
HeapFree
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetStringTypeW
GetConsoleCP
CreateFileW
user32
SetActiveWindow
GetClassLongA
advapi32
GetAce
ole32
CoTaskMemFree
Sections
.text Size: 415KB - Virtual size: 415KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 4.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ