1d6561c4714fadf16bcfb244a5444a959a953424d8e2c6acca6ccb2e20117e74

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21-09-2022 11:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Build.bat
Size

741B
MD5

4e46e28b2e61643f6af70a8b19e5cb1f
SHA1

804a1d0c4a280b18e778e4b97f85562fa6d5a4e6
SHA256

8e83a1727696ced618289f79674b97305d88beeeabf46bd25fc77ac53c1ae339
SHA512

009b17b515ff0ea612e54d8751eef07f1e2b54db07e6cd69a95e7adf775f3c79a0ea91bff2fe593f2314807fdc00c75d80f1807b7dbe90f0fcf94607e675047b

Score

1^/10

Malware Config

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 7 IoCs

pid	Process
1880	keygen.exe
888	builder.exe
980	builder.exe
1752	builder.exe
2040	builder.exe
1484	builder.exe
1992	builder.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 736 wrote to memory of 1880	736	cmd.exe	28
PID 736 wrote to memory of 1880	736	cmd.exe	28
PID 736 wrote to memory of 1880	736	cmd.exe	28
PID 736 wrote to memory of 1880	736	cmd.exe	28
PID 736 wrote to memory of 888	736	cmd.exe	29
PID 736 wrote to memory of 888	736	cmd.exe	29
PID 736 wrote to memory of 888	736	cmd.exe	29
PID 736 wrote to memory of 888	736	cmd.exe	29
PID 736 wrote to memory of 980	736	cmd.exe	30
PID 736 wrote to memory of 980	736	cmd.exe	30
PID 736 wrote to memory of 980	736	cmd.exe	30
PID 736 wrote to memory of 980	736	cmd.exe	30
PID 736 wrote to memory of 1752	736	cmd.exe	31
PID 736 wrote to memory of 1752	736	cmd.exe	31
PID 736 wrote to memory of 1752	736	cmd.exe	31
PID 736 wrote to memory of 1752	736	cmd.exe	31
PID 736 wrote to memory of 2040	736	cmd.exe	32
PID 736 wrote to memory of 2040	736	cmd.exe	32
PID 736 wrote to memory of 2040	736	cmd.exe	32
PID 736 wrote to memory of 2040	736	cmd.exe	32
PID 736 wrote to memory of 1484	736	cmd.exe	33
PID 736 wrote to memory of 1484	736	cmd.exe	33
PID 736 wrote to memory of 1484	736	cmd.exe	33
PID 736 wrote to memory of 1484	736	cmd.exe	33
PID 736 wrote to memory of 1992	736	cmd.exe	34
PID 736 wrote to memory of 1992	736	cmd.exe	34
PID 736 wrote to memory of 1992	736	cmd.exe	34
PID 736 wrote to memory of 1992	736	cmd.exe	34

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Build.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:736
- C:\Users\Admin\AppData\Local\Temp\keygen.exe
  keygen -path C:\Users\Admin\AppData\Local\Temp\Build -pubkey pub.key -privkey priv.key
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:1880
- C:\Users\Admin\AppData\Local\Temp\builder.exe
  builder -type dec -privkey C:\Users\Admin\AppData\Local\Temp\Build\priv.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3Decryptor.exe
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:888
- C:\Users\Admin\AppData\Local\Temp\builder.exe
  builder -type enc -exe -pubkey C:\Users\Admin\AppData\Local\Temp\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3.exe
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:980
- C:\Users\Admin\AppData\Local\Temp\builder.exe
  builder -type enc -exe -pass -pubkey C:\Users\Admin\AppData\Local\Temp\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3_pass.exe
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:1752
- C:\Users\Admin\AppData\Local\Temp\builder.exe
  builder -type enc -dll -pubkey C:\Users\Admin\AppData\Local\Temp\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3_Rundll32.dll
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2040
- C:\Users\Admin\AppData\Local\Temp\builder.exe
  builder -type enc -dll -pass -pubkey C:\Users\Admin\AppData\Local\Temp\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3_Rundll32_pass.dll
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:1484
- C:\Users\Admin\AppData\Local\Temp\builder.exe
  builder -type enc -ref -pubkey C:\Users\Admin\AppData\Local\Temp\Build\pub.key -config config.json -ofile C:\Users\Admin\AppData\Local\Temp\Build\LB3_ReflectiveDll_DllMain.dll
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:1992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Build\priv.key

Filesize
344B

MD5
9c6713d91fce8d362e153920cb54d680

SHA1
391688f633caa3415f44f8e85e7e8e8a1d4ee546

SHA256
78da53378038810e74479ec7c585fa264e28374a05ce15d8c4afa03dff8b9ab2

SHA512
1b020f84b7ebaa3154852cbb4a76b356a2a17c1086988ee768bc111f40dc9cc8fe44f38afbd3bdb8cdaf84c5000b477053d16ea247ec050c64f9552e24fc26b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Build\pub.key

Filesize
344B

MD5
d3a3eb387902df4e720d0cb32df4f578

SHA1
4c8221097027d7c97e4a9779f71db381fad01e7f

SHA256
c571075e86d3c04f89e96847fac20e8867e3a6ff7a6d03d424f6cb9941fc4afd

SHA512
e92ddc8a1b2ca30f71a9885cb32755525ab7d1a607c4c3e0a20975c106b8bd91a28d24876315f229aba4cd1f5ae86c8cdc549a719c0c0d6396d0794e1d3c5af0

Download Submit
memory/1880-55-0x0000000076201000-0x0000000076203000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads