Analysis
-
max time kernel
139s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
16-03-2024 04:03
General
-
Target
BattleText.exe
-
Size
79KB
-
MD5
ac98d5e7f59a9feb167f01c6749baccb
-
SHA1
80be262b88d22230ebd7a44e03ddd810092fdfb5
-
SHA256
c7e4b8b9ded5df50dc1b2b8e6af95cb6cfb310c20be19c879c48a83371b345da
-
SHA512
6ff2a6713691b097ccd678f6275624ed88561aa4458a3d5e2b9bfece60d4cfccdf0c4a88aba0728569126648c1a93972c45807ae077c60203f1eee63f5bca368
-
SSDEEP
768:nMEuOeT2wsgkVTMEAnqqbiHsT5OzK5cFCdkS4hqXoxWbeVLJE0PZL:MD9yQkrAPasTAzK5NdkuYxE4/PZL
Malware Config
Signatures
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BattleText.exe"C:\Users\Admin\AppData\Local\Temp\BattleText.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63
-
Filesize
104KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
256KB