Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    28-01-2024 04:27

General

  • Target

    InstallNet6.bat

  • Size

    74B

  • MD5

    f57b862f33a138ee0775d38ab1a7e669

  • SHA1

    58104a9b6fb269bfbe990680f6fb132c69e8f236

  • SHA256

    76db63b2394628ebc83f433301800cff921f3453e273a34a93f720304a1e1b78

  • SHA512

    9375f0d51702e35575d27048623b2a8c0c8cc4b882296cba61fbdd60c4a5edf7126daf2264bcabb398a5eaa63341a8ee15d127b76fe96b6853dea5d875d9866f

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\InstallNet6.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4568
    • C:\Users\Admin\AppData\Local\Temp\LordsMobileBot.exe
      LordsMobileBot.exe
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4492
      • C:\Users\Admin\AppData\Local\Temp\Updater.exe
        "C:\Users\Admin\AppData\Local\Temp\Updater.exe" --no-diag
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\DN40B6560D6598ABA0\HVMRun64.dll

    Filesize

    4.3MB

    MD5

    21184c4444b13c67546c7acf7f6ad8e3

    SHA1

    806fb111900a0ec8bee1f658c6828b9e005f1111

    SHA256

    14f61c269509eb27083883d5e8edcf9ed14f3b62cfbfb69f4f7434d64a7fa924

    SHA512

    9c55f71051f7c83d8644c7eaf500a5ea887aa75886480fcb607e3540f482afde0cc11396e3c2be936bd6418ce76a752132391c97b2620927a9a694eee99380eb

  • memory/4440-15-0x0000000000820000-0x000000000086A000-memory.dmp

    Filesize

    296KB

  • memory/4440-16-0x0000000074680000-0x0000000074E30000-memory.dmp

    Filesize

    7.7MB

  • memory/4440-17-0x00000000058B0000-0x0000000005E54000-memory.dmp

    Filesize

    5.6MB

  • memory/4440-18-0x0000000005300000-0x0000000005392000-memory.dmp

    Filesize

    584KB

  • memory/4440-19-0x00000000052D0000-0x00000000052E0000-memory.dmp

    Filesize

    64KB

  • memory/4440-20-0x0000000005260000-0x000000000526A000-memory.dmp

    Filesize

    40KB

  • memory/4440-22-0x0000000074680000-0x0000000074E30000-memory.dmp

    Filesize

    7.7MB

  • memory/4492-6-0x00007FFE2AA90000-0x00007FFE2AF8E000-memory.dmp

    Filesize

    5.0MB

  • memory/4492-11-0x00007FFE2D090000-0x00007FFE2D1F2000-memory.dmp

    Filesize

    1.4MB

  • memory/4492-23-0x00007FFE2AA90000-0x00007FFE2AF8E000-memory.dmp

    Filesize

    5.0MB