5cd50d57a32b96d16db5abb18023bc202afffbb894060ef2f0d59f03f65a906e

General

Target

CSRPS.exe
Size

9.1MB
MD5

74d3f521a38b23cd25ed61e4f8d99f16
SHA1

c4cd0e519aeca41e94665f2c5ea60a322deb3680
SHA256

1d822b3faabb8f65fc30076d32a95757a2c369ccb64ae54572e9f562280ae845
SHA512

ec1c8b0eb895fd8947cad6126abc5bca3a712e42475228b9dcb3496098e720abb83d4cba4621edbd8d3ad7f306a5f57ced9c2c98fe2c2d0c8ebbbf99d7faf0f1
SSDEEP

196608:bmFQso3Id5AypjCIN325pMKhQaLh6sOo5LZvqy1f:OQseId5AyZIpMKVLhJtJqS

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

3728 netsh.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

CSRPS.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation CSRPS.exe
Loads dropped DLL 2 IoCs

Processes:

CSRPS.exe

pid process

1636 CSRPS.exe
1636 CSRPS.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3728	netsh.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	CSRPS.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

CSRPS.exeSCHTASKS.execmd.execmd.exenetsh.exeschtasks.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CSRPS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SCHTASKS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

ipconfig.exe

pid process

1956 ipconfig.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

100 schtasks.exe

pid	process
1956	ipconfig.exe

pid	process
100	schtasks.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

Processes:

CSRPS.exe

pid	process
1636	CSRPS.exe
1636	CSRPS.exe
1636	CSRPS.exe
1636	CSRPS.exe
1636	CSRPS.exe
1636	CSRPS.exe
1636	CSRPS.exe
1636	CSRPS.exe
1636	CSRPS.exe
1636	CSRPS.exe
1636	CSRPS.exe
1636	CSRPS.exe
1636	CSRPS.exe
1636	CSRPS.exe
1636	CSRPS.exe
1636	CSRPS.exe
1636	CSRPS.exe
1636	CSRPS.exe
1636	CSRPS.exe
1636	CSRPS.exe
1636	CSRPS.exe
1636	CSRPS.exe
1636	CSRPS.exe
1636	CSRPS.exe
1636	CSRPS.exe
1636	CSRPS.exe
1636	CSRPS.exe
1636	CSRPS.exe
1636	CSRPS.exe
1636	CSRPS.exe
1636	CSRPS.exe
1636	CSRPS.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

CSRPS.exe

pid process

1636 CSRPS.exe
1636 CSRPS.exe
1636 CSRPS.exe
1636 CSRPS.exe
1636 CSRPS.exe
1636 CSRPS.exe
1636 CSRPS.exe
1636 CSRPS.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

CSRPS.execmd.execmd.exe

description	pid	process	target process
PID 1636 wrote to memory of 1472	1636	CSRPS.exe	SCHTASKS.exe
PID 1636 wrote to memory of 1472	1636	CSRPS.exe	SCHTASKS.exe
PID 1636 wrote to memory of 1472	1636	CSRPS.exe	SCHTASKS.exe
PID 1636 wrote to memory of 4800	1636	CSRPS.exe	cmd.exe
PID 1636 wrote to memory of 4800	1636	CSRPS.exe	cmd.exe
PID 1636 wrote to memory of 4800	1636	CSRPS.exe	cmd.exe
PID 1636 wrote to memory of 4596	1636	CSRPS.exe	cmd.exe
PID 1636 wrote to memory of 4596	1636	CSRPS.exe	cmd.exe
PID 1636 wrote to memory of 4596	1636	CSRPS.exe	cmd.exe
PID 4596 wrote to memory of 3728	4596	cmd.exe	netsh.exe
PID 4596 wrote to memory of 3728	4596	cmd.exe	netsh.exe
PID 4596 wrote to memory of 3728	4596	cmd.exe	netsh.exe
PID 4800 wrote to memory of 100	4800	cmd.exe	schtasks.exe
PID 4800 wrote to memory of 100	4800	cmd.exe	schtasks.exe
PID 4800 wrote to memory of 100	4800	cmd.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\CSRPS.exe
"C:\Users\Admin\AppData\Local\Temp\CSRPS.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\SysWOW64\SCHTASKS.exe
SCHTASKS /Query /TN "CSRPS"
2⤵
- System Location Discovery: System Language Discovery
PID:1472

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C SCHTASKS /Create /F /RL HIGHEST /TN "CSRPS" /TR "C:\Users\Admin\AppData\Local\Temp\CSRPS.exe" /SC ONLOGON /DELAY 0001:00
2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4800

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /Create /F /RL HIGHEST /TN "CSRPS" /TR "C:\Users\Admin\AppData\Local\Temp\CSRPS.exe" /SC ONLOGON /DELAY 0001:00
3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:100

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C netsh advfirewall firewall add rule name="CSRPS" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\CSRPS.exe" enable=yes profile=any
2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4596

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall add rule name="CSRPS" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\CSRPS.exe" enable=yes profile=any
3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3728

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ipconfig /flushdns
2⤵
PID:4768

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /flushdns
3⤵
- Gathers network information
PID:1956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hcx.dll

Filesize
398KB

MD5
287c055b14d6ab41b021486e4fef3708

SHA1
d705e8d163d60b39e0265e30a56966c58323bef3

SHA256
3976547348f3cd6887ad0bc6a1f1f54010b58ca5cc1a77a937e882def475ab9e

SHA512
fbc627c5d06ff4440d67f7fe97ad187bf6b6472ce9f0584e7ad3d1a391e7006db97d81ac6800a80bd8304172959f01a3bc72c55773d421f2332148731a71f0b1

Download Submit
C:\Users\Admin\AppData\Roaming\Scooter Software\Beyond Compare 3\BCState.xml

Filesize
309B

MD5
4689d0efb2ca0ad7daa242b24d745a1a

SHA1
050213ae67c50d4b10dc352f3ec7c2ba03626c9c

SHA256
bf010f67e7e9a83fc17ffd634d3f2ac5a80d54f9d0c688f3bc7ecb5e93eca5b6

SHA512
1268276a83dd5201251329ce41673e737ba54cbd7dffd3632c4030f5020571e42c6019e8abaaff0f1d32468b13228d4bee291d4737d2ca8ec5f9d3c8fe3eb63a

Download Submit
C:\Users\Admin\AppData\Roaming\Scooter Software\Beyond Compare 3\BCState.xml.bak

Filesize
184B

MD5
b1f998980222af62d90b11306a64525b

SHA1
2c9f44bc26838f53085bce97010e4cd2974cfb7c

SHA256
cc5e921e3e318aa5541f24f5d72cde1f2f022010c8f39eea3fa610ad5ac5c854

SHA512
58f75af5641da479d704834c11c45ce88076e7969b05b3849a58ada125ceafef318b3b46d582d8509312737a1264eaa689a36ba9bda3618c021740f5e371dbd6

Download Submit
memory/1636-15-0x00000000055C0000-0x000000000A096000-memory.dmp

Filesize
74.8MB

Download
memory/1636-1-0x00000000055C0000-0x000000000A096000-memory.dmp

Filesize
74.8MB

Download
memory/1636-10-0x000000000B9E0000-0x000000000BA48000-memory.dmp

Filesize
416KB

Download
memory/1636-6-0x0000000004520000-0x0000000004521000-memory.dmp

Filesize
4KB

Download
memory/1636-14-0x0000000000400000-0x0000000000D36000-memory.dmp

Filesize
9.2MB

Download
memory/1636-0-0x0000000004520000-0x0000000004521000-memory.dmp

Filesize
4KB

Download
memory/1636-4-0x0000000000400000-0x0000000000D36000-memory.dmp

Filesize
9.2MB

Download
memory/1636-5-0x00000000055C0000-0x000000000A096000-memory.dmp

Filesize
74.8MB

Download
memory/1636-27-0x0000000000400000-0x0000000000D36000-memory.dmp

Filesize
9.2MB

Download
memory/1636-28-0x00000000055C0000-0x000000000A096000-memory.dmp

Filesize
74.8MB

Download
memory/1636-30-0x00000000055C0000-0x000000000A096000-memory.dmp

Filesize
74.8MB

Download
memory/1636-32-0x00000000055C0000-0x000000000A096000-memory.dmp

Filesize
74.8MB

Download
memory/1636-34-0x00000000055C0000-0x000000000A096000-memory.dmp

Filesize
74.8MB

Download
memory/1636-39-0x00000000055C0000-0x000000000A096000-memory.dmp

Filesize
74.8MB

Download
memory/1636-47-0x00000000055C0000-0x000000000A096000-memory.dmp

Filesize
74.8MB

Download
memory/1636-51-0x00000000055C0000-0x000000000A096000-memory.dmp

Filesize
74.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads