b7dd3bce3ebfbc2d5e3a9f00d47f27cb6a5895c4618c878e314e573a7c216df1

Analysis

max time kernel
1558s
max time network
1565s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-12-2024 22:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

The-MALWARE-Repo-master/Trojan/L0Lz.bat
Size

6KB
MD5

74f8a282848b8a26ceafe1f438e358e0
SHA1

007b350c49b71b47dfc8dff003980d5f8da32b3a
SHA256

fc94130b45112bdf7fe64713eb807f4958cdcdb758c25605ad9318cd5a8e17ae
SHA512

3f73c734432b7999116452e673d734aa3f5fe9005efa7285c76d28a98b4c5d2620e772f421e030401ad223abbb07c6d0e79b91aa97b7464cb21e3dc0b49c5a81
SSDEEP

192:tlYUT1jLPD5mZkRr3TfLQ4/zus8joPRJRqU1jXEmo:tlY85XW

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2728	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat	xcopy.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat	xcopy.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2288	taskkill.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2288	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2568	2388	cmd.exe	32
PID 2388 wrote to memory of 2568	2388	cmd.exe	32
PID 2388 wrote to memory of 2568	2388	cmd.exe	32
PID 2568 wrote to memory of 2352	2568	net.exe	33
PID 2568 wrote to memory of 2352	2568	net.exe	33
PID 2568 wrote to memory of 2352	2568	net.exe	33
PID 2388 wrote to memory of 780	2388	cmd.exe	34
PID 2388 wrote to memory of 780	2388	cmd.exe	34
PID 2388 wrote to memory of 780	2388	cmd.exe	34
PID 780 wrote to memory of 3032	780	net.exe	35
PID 780 wrote to memory of 3032	780	net.exe	35
PID 780 wrote to memory of 3032	780	net.exe	35
PID 2388 wrote to memory of 2264	2388	cmd.exe	36
PID 2388 wrote to memory of 2264	2388	cmd.exe	36
PID 2388 wrote to memory of 2264	2388	cmd.exe	36
PID 2264 wrote to memory of 2488	2264	net.exe	37
PID 2264 wrote to memory of 2488	2264	net.exe	37
PID 2264 wrote to memory of 2488	2264	net.exe	37
PID 2388 wrote to memory of 2288	2388	cmd.exe	38
PID 2388 wrote to memory of 2288	2388	cmd.exe	38
PID 2388 wrote to memory of 2288	2388	cmd.exe	38
PID 2388 wrote to memory of 2760	2388	cmd.exe	40
PID 2388 wrote to memory of 2760	2388	cmd.exe	40
PID 2388 wrote to memory of 2760	2388	cmd.exe	40
PID 2760 wrote to memory of 2748	2760	net.exe	41
PID 2760 wrote to memory of 2748	2760	net.exe	41
PID 2760 wrote to memory of 2748	2760	net.exe	41
PID 2388 wrote to memory of 2440	2388	cmd.exe	42
PID 2388 wrote to memory of 2440	2388	cmd.exe	42
PID 2388 wrote to memory of 2440	2388	cmd.exe	42
PID 2440 wrote to memory of 2260	2440	net.exe	43
PID 2440 wrote to memory of 2260	2440	net.exe	43
PID 2440 wrote to memory of 2260	2440	net.exe	43
PID 2388 wrote to memory of 2728	2388	cmd.exe	44
PID 2388 wrote to memory of 2728	2388	cmd.exe	44
PID 2388 wrote to memory of 2728	2388	cmd.exe	44
PID 2388 wrote to memory of 2884	2388	cmd.exe	45
PID 2388 wrote to memory of 2884	2388	cmd.exe	45
PID 2388 wrote to memory of 2884	2388	cmd.exe	45
PID 2884 wrote to memory of 2880	2884	net.exe	46
PID 2884 wrote to memory of 2880	2884	net.exe	46
PID 2884 wrote to memory of 2880	2884	net.exe	46
PID 2388 wrote to memory of 1644	2388	cmd.exe	47
PID 2388 wrote to memory of 1644	2388	cmd.exe	47
PID 2388 wrote to memory of 1644	2388	cmd.exe	47
PID 2388 wrote to memory of 3040	2388	cmd.exe	48
PID 2388 wrote to memory of 3040	2388	cmd.exe	48
PID 2388 wrote to memory of 3040	2388	cmd.exe	48
PID 2388 wrote to memory of 2652	2388	cmd.exe	49
PID 2388 wrote to memory of 2652	2388	cmd.exe	49
PID 2388 wrote to memory of 2652	2388	cmd.exe	49
PID 2388 wrote to memory of 2640	2388	cmd.exe	50
PID 2388 wrote to memory of 2640	2388	cmd.exe	50
PID 2388 wrote to memory of 2640	2388	cmd.exe	50
PID 2388 wrote to memory of 2952	2388	cmd.exe	51
PID 2388 wrote to memory of 2952	2388	cmd.exe	51
PID 2388 wrote to memory of 2952	2388	cmd.exe	51
PID 2388 wrote to memory of 2968	2388	cmd.exe	52
PID 2388 wrote to memory of 2968	2388	cmd.exe	52
PID 2388 wrote to memory of 2968	2388	cmd.exe	52
PID 2388 wrote to memory of 304	2388	cmd.exe	53
PID 2388 wrote to memory of 304	2388	cmd.exe	53
PID 2388 wrote to memory of 304	2388	cmd.exe	53
PID 2388 wrote to memory of 2676	2388	cmd.exe	54

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\L0Lz.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:2352
- C:\Windows\system32\net.exe
  net stop "SDRSVC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:780
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "SDRSVC"
    3⤵
    PID:3032
- C:\Windows\system32\net.exe
  net stop "WinDefend"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "WinDefend"
    3⤵
    PID:2488
- C:\Windows\system32\taskkill.exe
  taskkill /f /t /im "MSASCui.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2288
- C:\Windows\system32\net.exe
  net stop "security center"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "security center"
    3⤵
    PID:2748
- C:\Windows\system32\net.exe
  net stop sharedaccess
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop sharedaccess
    3⤵
    PID:2260
- C:\Windows\system32\netsh.exe
  netsh firewall set opmode mode-disable
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2728
- C:\Windows\system32\net.exe
  net stop "wuauserv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "wuauserv"
    3⤵
    PID:2880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo tasklist "
  2⤵
  PID:1644
- C:\Windows\system32\find.exe
  find /I "L0Lz"
  2⤵
  PID:3040
- C:\Windows\system32\xcopy.exe
  XCOPY "BitcoinMiner.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
  2⤵
  - Drops startup file
  PID:2652
- C:\Windows\system32\xcopy.exe
  XCOPY "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat"
  2⤵
  PID:2640
- C:\Windows\system32\xcopy.exe
  XCOPY "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat"
  2⤵
  PID:2952
- C:\Windows\system32\xcopy.exe
  XCOPY "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat"
  2⤵
  PID:2968
- C:\Windows\system32\xcopy.exe
  XCOPY "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat"
  2⤵
  PID:304
- C:\Windows\system32\xcopy.exe
  XCOPY "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat"
  2⤵
  PID:2676
- C:\Windows\system32\xcopy.exe
  XCOPY "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat"
  2⤵
  PID:1864
- C:\Windows\system32\xcopy.exe
  XCOPY "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat"
  2⤵
  PID:1044
- C:\Windows\system32\xcopy.exe
  XCOPY "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat"
  2⤵
  PID:1612
- C:\Windows\system32\xcopy.exe
  XCOPY "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat"
  2⤵
  PID:1936
- C:\Windows\system32\xcopy.exe
  XCOPY "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat"
  2⤵
  PID:1648
- C:\Windows\system32\xcopy.exe
  XCOPY "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat"
  2⤵
  PID:2336
- C:\Windows\system32\xcopy.exe
  XCOPY "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat"
  2⤵
  PID:2072
- C:\Windows\system32\xcopy.exe
  XCOPY "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat"
  2⤵
  PID:2088
- C:\Windows\system32\xcopy.exe
  XCOPY "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat"
  2⤵
  PID:1924
- C:\Windows\system32\xcopy.exe
  XCOPY "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat"
  2⤵
  PID:2024
- C:\Windows\system32\xcopy.exe
  XCOPY "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat"
  2⤵
  PID:1788
- C:\Windows\system32\xcopy.exe
  XCOPY "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat"
  2⤵
  PID:1548
- C:\Windows\system32\xcopy.exe
  XCOPY "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat"
  2⤵
  PID:592
- C:\Windows\system32\xcopy.exe
  XCOPY "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat"
  2⤵
  PID:1808
- C:\Windows\system32\xcopy.exe
  XCOPY "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat"
  2⤵
  PID:2356
- C:\Windows\system32\xcopy.exe
  XCOPY "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat"
  2⤵
  PID:564
- C:\Windows\system32\xcopy.exe
  XCOPY "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat"
  2⤵
  PID:2916
- C:\Windows\system32\xcopy.exe
  XCOPY "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat"
  2⤵
  PID:2256
- C:\Windows\system32\xcopy.exe
  XCOPY "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat"
  2⤵
  PID:548
- C:\Windows\system32\xcopy.exe
  XCOPY "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat"
  2⤵
  PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Network Share Discovery

T1135

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\BitcoinMiner.bat

Filesize
300B

MD5
cb63bd942c87234d19663ff17d75cf52

SHA1
826aff7cc6ece64d7c5fc2d780ef887602c283b0

SHA256
e4a162e84753d3c8399dcad2a287d9ca496823c065c953be64ea6ce71bf435a8

SHA512
63c98807ade96132701e2794049ab99b43c3edbfc8cc9f20f03c433b3220b01876d70458cf11d84a239492409047840bace97860824e8160587e6ca8008a493a

Download Submit
C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\BitcoinMiner.bat

Filesize
300B

MD5
4aa09c46db228e7f610ad440cd89c103

SHA1
b23b62bbd22a602b113038a07217c6abcb156f06

SHA256
d13d4a8b3b8add19b5970157f09d00c12cbda4fed4d74d8493156523f7069b66

SHA512
72648deb391416ce55820d413f21fd2ecd18617c62955858059ed96815380e960c2bb005f7b792c82a9bb6022ebfe0c13af97c2be2c243a63a16267a2a8037da

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads