analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

csrss.exe

Full analysis: https://app.any.run/tasks/7a7cbc17-6a3f-43ff-922f-05ab396208ea
Verdict: Malicious activity
Threats:

LokiBot was developed in 2015 to steal information from a variety of applications. Despite the age, this malware is still rather popular among cybercriminals.

Malware Trends Tracker     >>>
Analysis date: December 06, 2022, 03:16:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
lokibot
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

58A93725B592923568EDE95C067E81B2

SHA1:

430A4999034DD4DB67F6F1BB370109A5DC6EE9E3

SHA256:

4F52928B3599DDE5382B84B16CF8482A5E840F30F94EF11A100F624AC1839506

SSDEEP:

12288:LcnZ75OyvUOASfN3gPsQ0rA/QXIsYN5IyjmaxgKZ/nXt7virmWhlGLaQYI:Ynx5fflmsQ0rA/QXIsY1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LOKIBOT detected by memory dumps

      • csrss.exe (PID: 3200)

    • Lokibot is detected

      • csrss.exe (PID: 3200)

    • Steals credentials from Web Browsers

      • csrss.exe (PID: 3200)

  • SUSPICIOUS

    • Connects to the server without a host name

      • csrss.exe (PID: 3200)

    • Reads the Internet Settings

      • csrss.exe (PID: 3200)

    • Reads Mozilla Firefox installation path

      • csrss.exe (PID: 3200)

    • Application launched itself

      • csrss.exe (PID: 1540)

    • Loads DLL from Mozilla Firefox

      • csrss.exe (PID: 3200)

  • INFO

    • Checks supported languages

      • csrss.exe (PID: 1540)
      • csrss.exe (PID: 3200)

    • Reads the computer name

      • csrss.exe (PID: 1540)
      • csrss.exe (PID: 3200)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

LokiBot

(PID) Process(3200) csrss.exe
C2208.67.105.161/gk2/five/fre.php
Decoys (4)kbfvzoboss.bid/alien/fre.php
alphastand.trade/alien/fre.php
alphastand.win/alien/fre.php
alphastand.top/alien/fre.php
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2081-Aug-22 23:48:03
Comments: -
CompanyName: Microsoft
FileDescription: CadMotorista
FileVersion: 1.0.0.0
InternalName: Vpxa.exe
LegalCopyright: Copyright © 2020
LegalTrademarks: -
OriginalFilename: Vpxa.exe
ProductName: CadMotorista
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 128

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 3
TimeDateStamp: 2081-Aug-22 23:48:03
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
8192
754092
754176
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
7.27977
.rsrc
770048
904
1024
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
2.85393
.reloc
778240
12
512
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
0.10191

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.26468
812
UNKNOWN
UNKNOWN
RT_VERSION

Imports

mscoree.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start csrss.exe no specs #LOKIBOT csrss.exe

Process information

PID
CMD
Path
Indicators
Parent process
1540"C:\Users\admin\AppData\Local\Temp\csrss.exe" C:\Users\admin\AppData\Local\Temp\csrss.exe—Explorer.EXE
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
CadMotorista
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\csrss.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3200"C:\Users\admin\AppData\Local\Temp\csrss.exe"C:\Users\admin\AppData\Local\Temp\csrss.exe
csrss.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
CadMotorista
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\csrss.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\nsi.dll
LokiBot
(PID) Process(3200) csrss.exe
C2208.67.105.161/gk2/five/fre.php
Decoys (4)kbfvzoboss.bid/alien/fre.php
alphastand.trade/alien/fre.php
alphastand.win/alien/fre.php
alphastand.top/alien/fre.php
Total events
591
Read events
588
Write events
3
Delete events
0

Modification events

(PID) Process:(3200) csrss.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3200) csrss.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3200) csrss.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
0
Suspicious files
1
Text files
1
Unknown types
2

Dropped files

PID
Process
Filename
Type
3200csrss.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\0f5007522459c86e95ffcc62f32308f1_90059c37-1320-41a4-b58d-2b75a9850d2fabr
MD5:D898504A722BFF1524134C6AB6A5EAA5
SHA256:878F32F76B159494F5A39F9321616C6068CDB82E88DF89BCC739BBC1EA78E1F9
3200csrss.exeC:\Users\admin\AppData\Roaming\F63AAA\A71D80.lckbinary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
3200csrss.exeC:\Users\admin\AppData\Roaming\F63AAA\A71D80.hdbtext
MD5:F93EEDDC7806D631C5E35AD6C33EB8AB
SHA256:32BA3839E8045109C78A62AE312130ADE9C8DE6EBD98FDA5BF394327D7A6AB43
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
3
DNS requests
0
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3200
csrss.exe
POST
—
208.67.105.161:80
http://208.67.105.161/gk2/five/fre.php
US
—
—
malicious
3200
csrss.exe
POST
404
208.67.105.161:80
http://208.67.105.161/gk2/five/fre.php
US
text
15 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3200
csrss.exe
208.67.105.161:80
—
Delis LLC
US
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
3200
csrss.exe
A Network Trojan was detected
ET TROJAN LokiBot User-Agent (Charon/Inferno)
3200
csrss.exe
A Network Trojan was detected
ET TROJAN LokiBot Checkin
3200
csrss.exe
A Network Trojan was detected
ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1
3200
csrss.exe
A Network Trojan was detected
ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2
3200
csrss.exe
A Network Trojan was detected
ET TROJAN LokiBot User-Agent (Charon/Inferno)
3200
csrss.exe
A Network Trojan was detected
ET TROJAN LokiBot Checkin
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
csrss.exe