popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

csrss.exe

Backdoor Client SW User Data Stealer RemcosRAT info stealer browser Chrome Malicious Library Malicious Packer Downloader Antivirus UPX Google User Data DNS ScreenShot Create Service KeyLogger Internet API Socket Escalate priviledges PWS Sniff Audio
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us July 26, 2024, 6:37 p.m. July 26, 2024, 6:41 p.m.
Size 2.5MB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 4fb3e6e7b8f9c12cd2d5e161f7b94760
SHA256 f76f9b85df2ba8850bec058164d2c752c8fd8ef0f1bcffd793e5f453d8a839bb
CRC32 79DF6B7A
ssdeep 49152:Og7eO7kjTav5AwVZGsY3uS+s1vm1lvt+vU0JSziMwqM:j7lmmUM7wq
PDB Path îäkd². a×r®®–¢k„zˆáØõý¶¿4ve{^ *Þ:bº¡¸²¾r¸`K'öÀùÚ£¸қP]û§˜i¾·™0X‰R¬O¹~°{JB:úX1‚jA=
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE64 - (no description)
  • Antivirus - Contains references to security software
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
geoplugin.net
A 178.237.33.50
178.237.33.50
unifrieghtmovers.com
A 23.95.60.82
23.95.60.82
IP Address Status Action
164.124.101.2 Active Moloch
178.237.33.50 Active Moloch
23.95.60.82 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49165 -> 23.95.60.82:2558 2036594 ET JA3 Hash - Remcos 3.x/4.x TLS Connection Malware Command and Control Activity Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.3
192.168.56.103:49165
23.95.60.82:2558 		None None None

pdb_path îäkd². a×r®®–¢k„zˆáØõý¶¿4ve{^ *Þ:bº¡¸²¾r¸`K'öÀùÚ£¸қP]û§˜i¾·™0X‰R¬O¹~°{JB:úX1‚jA=
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .managed
section hydrated
resource name BINARY
suspicious_features GET method with no useragent header suspicious_request GET http://geoplugin.net/json.gp
request GET http://geoplugin.net/json.gp
section {u'size_of_data': u'0x000c4a00', u'virtual_address': u'0x0019b000', u'entropy': 6.8323860285440015, u'name': u'.rdata', u'virtual_size': u'0x000c4826'} entropy 6.83238602854 description A section with a high entropy has been found
section {u'size_of_data': u'0x00079400', u'virtual_address': u'0x00283000', u'entropy': 7.999346124339988, u'name': u'.rsrc', u'virtual_size': u'0x000793a0'} entropy 7.99934612434 description A section with a high entropy has been found
entropy 0.487258095421 description Overall entropy of this PE file is high
description Create a windows service rule Create_Service
description Client_SW_User_Data_Stealer rule Client_SW_User_Data_Stealer
description Win Backdoor RemcosRAT rule Win_Backdoor_RemcosRAT
description Communications over RAW Socket rule Network_TCP_Socket
description browser info stealer rule infoStealer_browser_Zero
description Take ScreenShot rule ScreenShot
description Escalate priviledges rule Escalate_priviledges
description Google Chrome User Data Check rule Chrome_User_Data_Check_Zero
description PWS Memory rule Generic_PWS_Memory_Zero
description Record Audio rule Sniff_Audio
description Communications use DNS rule Network_DNS
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description File Downloader rule Network_Downloader
description Match Windows Inet API call rule Str_Win32_Internet_API
description Run a KeyLogger rule KeyLogger
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2116
region_size: 532480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000000000000118
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2180
region_size: 532480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000000000000011c
1 0 0
Process injection Process 880 manipulating memory of non-child process 2116
Time & API Arguments Status Return Repeated

NtUnmapViewOfSection

 base_address: 0x0000000000400000
region_size: 10747904
process_identifier: 2116
process_handle: 0x0000000000000118
-1073741799 0

NtAllocateVirtualMemory

 process_identifier: 2116
region_size: 532480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000000000000118
1 0 0
Bkav W64.AIDetectMalware
Elastic malicious (high confidence)
Skyhigh BehavesLike.Win64.Agent.vc
Cybereason malicious.7b8f9c
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win64/GenKryptik.GZZF
APEX Malicious
Avast MalwareX-gen [Trj]
Kaspersky VHO:Trojan.Win32.Agent.gen
Rising Trojan.Injector!1.FCBE (CLASSIC)
Google Detected
Microsoft Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm VHO:Trojan.Win32.Agent.gen
Malwarebytes Malware.AI.1498013564
Ikarus Trojan.Win64.Crypt
huorong HEUR:Trojan/Injector.as
MaxSecure Trojan.Malware.300983.susgen
Fortinet W64/GenKryptik.MAGC!tr
AVG MalwareX-gen [Trj]
Process injection Process 880 resumed a thread in remote process 2180
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x0000000000000120
suspend_count: 1
process_identifier: 2180
1 0 0
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000000000000b0
suspend_count: 1
process_identifier: 880
1 0 0

NtResumeThread

 thread_handle: 0x00000000000000f4
suspend_count: 1
process_identifier: 880
1 0 0

CreateProcessInternalW

 thread_identifier: 2120
thread_handle: 0x0000000000000114
process_identifier: 2116
current_directory:
filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
track: 1
command_line:
filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000000000000118
1 1 0

NtUnmapViewOfSection

 base_address: 0x0000000000400000
region_size: 10747904
process_identifier: 2116
process_handle: 0x0000000000000118
-1073741799 0

NtAllocateVirtualMemory

 process_identifier: 2116
region_size: 532480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000000000000118
1 0 0

CreateProcessInternalW

 thread_identifier: 2184
thread_handle: 0x0000000000000120
process_identifier: 2180
current_directory:
filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
track: 1
command_line:
filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x000000000000011c
1 1 0

NtUnmapViewOfSection

 base_address: 0x0000000000400000
region_size: 1999372288
process_identifier: 2180
process_handle: 0x000000000000011c
-1073741799 0

NtAllocateVirtualMemory

 process_identifier: 2180
region_size: 532480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000000000000011c
1 0 0

NtResumeThread

 thread_handle: 0x0000000000000120
suspend_count: 1
process_identifier: 2180
1 0 0