IOC Report

4t4y4r89UZ.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

PE32+ executable (DLL) (GUI) x86-64, for MS Windows

dropped

C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe

PE32+ executable (console) x86-64, for MS Windows

dropped

C:\Windows\rss\csrss.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Windows\windefender.exe

PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed

modified

C:\Users\user\Desktop\4t4y4r89UZ.exe

"C:\Users\user\Desktop\4t4y4r89UZ.exe"

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService

C:\Windows\System32\svchost.exe

c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc

C:\Windows\System32\svchost.exe

c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p

C:\Windows\System32\svchost.exe

c:\windows\system32\svchost.exe -k unistacksvcgroup

C:\Windows\System32\svchost.exe

c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc

C:\Users\user\Desktop\4t4y4r89UZ.exe

C:\Users\user\Desktop\4t4y4r89UZ.exe

C:\Windows\System32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"