Overview

overview

7

Static

static

3

csrss.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    csrss.exe

  • Size

    638KB

  • Sample

    240716-kl5knswhpa

  • MD5

    12c26ab43202d2ef17553eeb17376c2a

  • SHA1

    0b6226071ab1711bbbfaca2cdad6783d2658d797

  • SHA256

    cb56bffb224d9bcff0753d58995c25f6f944bcb075560019cd87283e3b443aa3

  • SHA512

    215e497f9ead486e618b940109553a703042cc0dcd7802cd7c36aac296ddfe27a5ce693891ed50e64dd68a03ba029928ab2c302a38de04e02e5ce3b3c0661f79

  • SSDEEP

    12288:RQi9zSYMvrOK9BOKjHol+yFnWVOjTPlxsU807BN/9+FJeyuAJMX7QYQ:RQiE7eORaEOjRxsUrLUoJi

Score
7/10
discovery

Malware Config

Targets

    • Target

      csrss.exe

    • Size

      638KB

    • MD5

      12c26ab43202d2ef17553eeb17376c2a

    • SHA1

      0b6226071ab1711bbbfaca2cdad6783d2658d797

    • SHA256

      cb56bffb224d9bcff0753d58995c25f6f944bcb075560019cd87283e3b443aa3

    • SHA512

      215e497f9ead486e618b940109553a703042cc0dcd7802cd7c36aac296ddfe27a5ce693891ed50e64dd68a03ba029928ab2c302a38de04e02e5ce3b3c0661f79

    • SSDEEP

      12288:RQi9zSYMvrOK9BOKjHol+yFnWVOjTPlxsU807BN/9+FJeyuAJMX7QYQ:RQiE7eORaEOjRxsUrLUoJi

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks