dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c

General

Target

dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
Size

2.3MB
MD5

8c7721a07d8a75318cd69d3e99e6f26f
SHA1

e689e4b95e1adab3dc8b3aa86679de192f380577
SHA256

dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c
SHA512

8b693458e5032302de273e4181de78d1228f0753913ac54f078176c8419cfd45a21e2de8ffaea958f977eb8637142b331807f75557999733f98cfdbfc29f66f6
SSDEEP

49152:g/K22SdQ1bMbFg1Um7t/cxKlW667eR0HO8jgwCsyKlr2mgxvJ:g/K22Sd4nJ7t/tlNPjKlqhh

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

reg.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Local\\csrssx.exe,"	reg.exe

Executes dropped EXE 1 IoCs

Processes:

csrssx.exe

pid	Process
2940	csrssx.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.execmd.exePING.EXEcmd.exePING.EXEreg.exePING.EXEcsrssx.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrssx.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

Processes:

cmd.exePING.EXEcmd.exePING.EXEPING.EXE

pid	Process
3896	cmd.exe
3692	PING.EXE
4136	cmd.exe
1308	PING.EXE
3568	PING.EXE

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

Processes:

PING.EXEPING.EXEPING.EXE

pid	Process
3692	PING.EXE
1308	PING.EXE
3568	PING.EXE

Suspicious behavior: EnumeratesProcesses 27 IoCs

Processes:

dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.execsrssx.exe

pid	Process
3132	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
3132	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
3132	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
3132	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
3132	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
3132	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
3132	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
3132	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
3132	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
3132	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
3132	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
3132	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
3132	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
3132	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
3132	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
3132	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
3132	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
3132	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
3132	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
3132	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
3132	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
3132	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
3132	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
3132	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
2940	csrssx.exe
2940	csrssx.exe
2940	csrssx.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.execsrssx.exe

description	pid	Process
Token: SeDebugPrivilege	3132	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
Token: SeDebugPrivilege	2940	csrssx.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.execmd.execmd.exe

description	pid	Process	procid_target
PID 3132 wrote to memory of 3896	3132	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe	91
PID 3132 wrote to memory of 3896	3132	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe	91
PID 3132 wrote to memory of 3896	3132	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe	91
PID 3896 wrote to memory of 3692	3896	cmd.exe	93
PID 3896 wrote to memory of 3692	3896	cmd.exe	93
PID 3896 wrote to memory of 3692	3896	cmd.exe	93
PID 3132 wrote to memory of 4136	3132	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe	103
PID 3132 wrote to memory of 4136	3132	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe	103
PID 3132 wrote to memory of 4136	3132	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe	103
PID 4136 wrote to memory of 1308	4136	cmd.exe	105
PID 4136 wrote to memory of 1308	4136	cmd.exe	105
PID 4136 wrote to memory of 1308	4136	cmd.exe	105
PID 3896 wrote to memory of 1520	3896	cmd.exe	106
PID 3896 wrote to memory of 1520	3896	cmd.exe	106
PID 3896 wrote to memory of 1520	3896	cmd.exe	106
PID 4136 wrote to memory of 3568	4136	cmd.exe	107
PID 4136 wrote to memory of 3568	4136	cmd.exe	107
PID 4136 wrote to memory of 3568	4136	cmd.exe	107
PID 4136 wrote to memory of 2940	4136	cmd.exe	108
PID 4136 wrote to memory of 2940	4136	cmd.exe	108
PID 4136 wrote to memory of 2940	4136	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
"C:\Users\Admin\AppData\Local\Temp\dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c ping 127.0.0.1 -n 35 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\csrssx.exe,"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 35
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3692
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\csrssx.exe,"
    3⤵
    - Modifies WinLogon for persistence
    - System Location Discovery: System Language Discovery
    PID:1520
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c ping 127.0.0.1 -n 45 > nul && copy "C:\Users\Admin\AppData\Local\Temp\dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe" "C:\Users\Admin\AppData\Local\csrssx.exe" && ping 127.0.0.1 -n 45 > nul && "C:\Users\Admin\AppData\Local\csrssx.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 45
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1308
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 45
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3568
- - C:\Users\Admin\AppData\Local\csrssx.exe
    "C:\Users\Admin\AppData\Local\csrssx.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\csrssx.exe

Filesize
2.3MB

MD5
8c7721a07d8a75318cd69d3e99e6f26f

SHA1
e689e4b95e1adab3dc8b3aa86679de192f380577

SHA256
dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c

SHA512
8b693458e5032302de273e4181de78d1228f0753913ac54f078176c8419cfd45a21e2de8ffaea958f977eb8637142b331807f75557999733f98cfdbfc29f66f6

Download Submit
memory/2940-21-0x00000000744A0000-0x0000000074C50000-memory.dmp

Filesize
7.7MB

Download
memory/2940-20-0x00000000744A0000-0x0000000074C50000-memory.dmp

Filesize
7.7MB

Download
memory/2940-18-0x00000000744A0000-0x0000000074C50000-memory.dmp

Filesize
7.7MB

Download
memory/2940-19-0x0000000000F10000-0x0000000001168000-memory.dmp

Filesize
2.3MB

Download
memory/3132-4-0x00000000057F0000-0x0000000005882000-memory.dmp

Filesize
584KB

Download
memory/3132-6-0x0000000005890000-0x00000000058D4000-memory.dmp

Filesize
272KB

Download
memory/3132-7-0x0000000005CD0000-0x0000000005CDA000-memory.dmp

Filesize
40KB

Download
memory/3132-8-0x00000000744D0000-0x0000000074C80000-memory.dmp

Filesize
7.7MB

Download
memory/3132-9-0x00000000744DE000-0x00000000744DF000-memory.dmp

Filesize
4KB

Download
memory/3132-10-0x00000000744D0000-0x0000000074C80000-memory.dmp

Filesize
7.7MB

Download
memory/3132-12-0x00000000744D0000-0x0000000074C80000-memory.dmp

Filesize
7.7MB

Download
memory/3132-5-0x00000000744D0000-0x0000000074C80000-memory.dmp

Filesize
7.7MB

Download
memory/3132-0-0x00000000744DE000-0x00000000744DF000-memory.dmp

Filesize
4KB

Download
memory/3132-3-0x0000000005DA0000-0x0000000006344000-memory.dmp

Filesize
5.6MB

Download
memory/3132-2-0x0000000005690000-0x000000000572C000-memory.dmp

Filesize
624KB

Download
memory/3132-1-0x00000000009D0000-0x0000000000C28000-memory.dmp

Filesize
2.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads