General
-
Target
NightyBatchDropper.bat
-
Size
5KB
-
Sample
240507-t93weshf32
-
MD5
e6ab5c0e289dec446649106e3ae5967e
-
SHA1
5ceb0cc36503829a268805a76b29fbc0741c5445
-
SHA256
caef8631cfa691871889f8f211d50823d55f06227b0c3d3ab619ef83d70c147a
-
SHA512
b3cb2e62e5bd564ca4ef31833f27a332bd3594bccd6c75a3b2947ebceffee06b3eb7f48434bcdd6fbe617780f4dd4bcf69595fdf36b86198e9fa95263b6c5bf6
-
SSDEEP
96:O6fB4ORjW1Dy29DBi0xtymoN++MfVEj/TImnhofGlBvYnbhCz48CbuCpxi2K1tlX:OofeU+tLohTleG/wnO6ppxi5yvRQq6sc
Static task
static1
Behavioral task
behavioral1
Sample
NightyBatchDropper.bat
Resource
win11-20240419-en
Malware Config
Extracted
xworm
45.88.90.198:1500
-
Install_directory
%AppData%
-
install_file
WindowSC.exe
Targets
-
-
Target
NightyBatchDropper.bat
-
Size
5KB
-
MD5
e6ab5c0e289dec446649106e3ae5967e
-
SHA1
5ceb0cc36503829a268805a76b29fbc0741c5445
-
SHA256
caef8631cfa691871889f8f211d50823d55f06227b0c3d3ab619ef83d70c147a
-
SHA512
b3cb2e62e5bd564ca4ef31833f27a332bd3594bccd6c75a3b2947ebceffee06b3eb7f48434bcdd6fbe617780f4dd4bcf69595fdf36b86198e9fa95263b6c5bf6
-
SSDEEP
96:O6fB4ORjW1Dy29DBi0xtymoN++MfVEj/TImnhofGlBvYnbhCz48CbuCpxi2K1tlX:OofeU+tLohTleG/wnO6ppxi5yvRQq6sc
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Detect Xworm Payload
-
StormKitty payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Blocklisted process makes network request
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1