08d215fd35494280e6397e8bc527bd6de64eb78a73acd3bd07a01da376ed4cb7

Analysis

max time kernel
139s
max time network
145s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-03-2024 04:03

Target

BattleText.exe
Size

79KB
MD5

ac98d5e7f59a9feb167f01c6749baccb
SHA1

80be262b88d22230ebd7a44e03ddd810092fdfb5
SHA256

c7e4b8b9ded5df50dc1b2b8e6af95cb6cfb310c20be19c879c48a83371b345da
SHA512

6ff2a6713691b097ccd678f6275624ed88561aa4458a3d5e2b9bfece60d4cfccdf0c4a88aba0728569126648c1a93972c45807ae077c60203f1eee63f5bca368
SSDEEP

768:nMEuOeT2wsgkVTMEAnqqbiHsT5OzK5cFCdkS4hqXoxWbeVLJE0PZL:MD9yQkrAPasTAzK5NdkuYxE4/PZL

Score

9^/10

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

Processes:

resource	yara_rule
behavioral15/memory/2300-0-0x0000000001370000-0x000000000138A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

Processes:

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

BattleText.exe

description pid process

Token: SeDebugPrivilege 2300 BattleText.exe

description	pid	process
Token: SeDebugPrivilege	2300	BattleText.exe

C:\Users\Admin\AppData\Local\Temp\BattleText.exe
"C:\Users\Admin\AppData\Local\Temp\BattleText.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2300

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

Resource Development

Reconnaissance

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6A3F.tmp
Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit
memory/2300-0-0x0000000001370000-0x000000000138A000-memory.dmp

Filesize
104KB

Download
memory/2300-1-0x00000000741A0000-0x000000007488E000-memory.dmp

Filesize
6.9MB

Download
memory/2300-2-0x0000000001300000-0x0000000001340000-memory.dmp

Filesize
256KB

Download
memory/2300-60-0x00000000741A0000-0x000000007488E000-memory.dmp

Filesize
6.9MB

Download
memory/2300-61-0x0000000001300000-0x0000000001340000-memory.dmp

Filesize
256KB

Download