Overview
overview
10Static
static
1stodio.bat
windows7-x64
1stodio.bat
windows10-2004-x64
1stodio.ps1
windows7-x64
10stodio.ps1
windows10-2004-x64
10stodio.vbs
windows7-x64
3stodio.vbs
windows10-2004-x64
7zilla.bat
windows7-x64
1zilla.bat
windows10-2004-x64
1zilla.ps1
windows7-x64
1zilla.ps1
windows10-2004-x64
1zilla.vbs
windows7-x64
3zilla.vbs
windows10-2004-x64
7Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231201-en -
resource tags
arch:x64arch:x86image:win7-20231201-enlocale:en-usos:windows7-x64system -
submitted
05-12-2023 17:55
Static task
static1
Behavioral task
behavioral1
Sample
stodio.bat
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
stodio.bat
Resource
win10v2004-20231130-en
Behavioral task
behavioral3
Sample
stodio.ps1
Resource
win7-20231201-en
Behavioral task
behavioral4
Sample
stodio.ps1
Resource
win10v2004-20231130-en
Behavioral task
behavioral5
Sample
stodio.vbs
Resource
win7-20231201-en
Behavioral task
behavioral6
Sample
stodio.vbs
Resource
win10v2004-20231130-en
Behavioral task
behavioral7
Sample
zilla.bat
Resource
win7-20231130-en
Behavioral task
behavioral8
Sample
zilla.bat
Resource
win10v2004-20231127-en
Behavioral task
behavioral9
Sample
zilla.ps1
Resource
win7-20231023-en
Behavioral task
behavioral10
Sample
zilla.ps1
Resource
win10v2004-20231127-en
Behavioral task
behavioral11
Sample
zilla.vbs
Resource
win7-20231023-en
Behavioral task
behavioral12
Sample
zilla.vbs
Resource
win10v2004-20231127-en
General
-
Target
stodio.vbs
-
Size
2KB
-
MD5
08013d5a23f8a6a47543e55260992e13
-
SHA1
e15610a3f106ea4be584f805a02441af4026316b
-
SHA256
fe26ba12a9ed10bc5d59ca5f186e66302482a69019d21fef8b1f2635942593a5
-
SHA512
244b57a0bf339e536b5593492686631e492ce6eb54d4586305eefe44af28ea25a33d9f2efa28293545cd3d0997ad40af4fa8301cc2669c86fb012e0bdb39f1eb
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
WScript.exenet.exedescription pid process target process PID 1876 wrote to memory of 3056 1876 WScript.exe net.exe PID 1876 wrote to memory of 3056 1876 WScript.exe net.exe PID 1876 wrote to memory of 3056 1876 WScript.exe net.exe PID 3056 wrote to memory of 1720 3056 net.exe net1.exe PID 3056 wrote to memory of 1720 3056 net.exe net1.exe PID 3056 wrote to memory of 1720 3056 net.exe net1.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\stodio.vbs"1⤵
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" session2⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session3⤵PID:1720